SUSE-SU-2024:1317-1 Security update for emacs

This update for emacs fixes the following issues: - CVE-2024-30203: Fixed denial of service via MIME contents bsc1222053 - CVE-2024-30204: Fixed denial of service via LaTeX preview in e-mail attachments bsc1222052 - CVE-2024-30205: Fixed Org mode considering contents of remote files as trusted...

PT-2024-23860 · Discourse · Discourse-Reactions

Name of the Vulnerable Software and Affected Versions: Discourse-reactions plugin affected versions not specified Description: The issue concerns the Discourse-reactions plugin, which allows users to add reactions to posts. When whispers are enabled on a site via the whispers allowed groups...

WordPress TOP Table Of Contents plugin <= 1.3.15 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin TOP Table Of Contents versions = 1.3.15...

WordPress TOP Table Of Contents Plugin <= 1.3.15 is vulnerable to Cross Site Request Forgery (CSRF)

Software TOP Table Of Contents Type Plugin Vulnerable versions = 1.3.15 Fixed in 1.3.16 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32110 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b11059e9c542 Credits Dhabaleshwa...

CVE-2024-31214

Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. Attackers have full control over the file contents, full control over the directory where the file is stored, full control over the file...

AZL-43182 CVE-2024-1984 affecting package graphene 1.10.8-1

The Graphene theme for WordPress is vulnerable to unauthorized access of data via meta tag in all versions up to, and including, 2.9.2. This makes it possible for unauthenticated individuals to obtain post contents of password protected posts via the generated source...

PT-2024-15903 · WordPress · S2Member

Name of the Vulnerable Software and Affected Versions: s2Member plugin for WordPress versions prior to 230816 Description: The issue allows unauthenticated attackers to expose information via the API, making it possible to see the contents of posts and pages. Recommendations: For versions prior t...

CVE-2024-22053

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory...

Nextcloud: User can copy locked folders and gain access to the contents

A vulnerability in Nextcloud allowed users to copy locked folders and access their contents...

Ivanti Policy Secure 9.x / 22.x Multiple Vulnerabilities (CVE-2024-21894)

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities: - A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially...

The vulnerability of the buf_contents_changed() function in the Vim text editor allows a hacker to trigger a service failure.

The vulnerability of the bufcontentschanged function in the Vim text editor is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

MGASA-2024-0104 Updated emacs packages fix security vulnerabilities

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. CVE-2024-30202 In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is enabled by default for e-mail...

Updated emacs packages fix security vulnerabilities

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. CVE-2024-30202 In Emacs before 29.3, Gnus treats inline MIME contents as trusted. CVE-2024-30203 In Emacs before 29.3, LaTeX preview is enabled by default for e-mail...

Asterisk AMI - Partial File Content & Path Disclosure (Authenticated) Exploit

Exploit Title: Asterisk AMI - Partial File Content & Path Disclosure Authenticated Date: 2023-03-26 Exploit Author: Sean Pesce Vendor Homepage: https://asterisk.org/ Software Link: https://downloads.asterisk.org/pub/telephony/asterisk/old-releases/ Version: 18.20.0 Tested on: Debian Linux CVE:...

AZL-37104 CVE-2024-30203 affecting package emacs for versions less than 29.3-1

In Emacs before 29.3, Gnus treats inline MIME contents as trusted...

AZL-37081 CVE-2024-30203 affecting package emacs for versions less than 29.3-1

In Emacs before 29.3, Gnus treats inline MIME contents as trusted...

UBUNTU-CVE-2024-30203

In Emacs before 29.3, Gnus treats inline MIME contents as trusted...

CVE-2024-28183 Anti Rollback bypass with physical access and TOCTOU attack

ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use TOCTOU vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass...

[SECURITY] [DLA 3766-1] zfs-linux security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-3766-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta March 19, 2024 https://wiki.debian.org/LTS -...

EulerOS Virtualization 2.10.0 : libXpm (EulerOS-SA-2024-1385)

According to the versions of the libXpm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer function. This flaw allows ...