GNOME Project G Structured File Library (libgsf) Compound Document Binary File Directory integer overflow vulnerability

Talos Vulnerability Report TALOS-2024-2068 GNOME Project G Structured File Library libgsf Compound Document Binary File Directory integer overflow vulnerability October 3, 2024 CVE Number CVE-2024-36474 SUMMARY An integer overflow vulnerability exists in the Compound Document Binary File format...

GHSA-79GP-Q4WV-33FR Cross-Site Request Forgery (CSRF) in strawberry-graphql

Impact Multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawberry HTTP view integrations vulnerable to CSRF attacks if users did not explicitly enable CSRF preventing security...

CGA-2GXC-MCCH-RV3G

Bulletin has no description...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.51 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.51 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

[SECURITY] Fedora 39 Update: python3-docs-3.12.6-1.fc39

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

Metasploit Weekly Wrap-Up 09/20/2024

New module content 3 update-motd.d Persistence Author: Julien Voisin Type: Exploit Pull request: 19454 contributed by jvoisin Path: linux/local/motdpersistence Description: This adds a post module to keep persistence on a Linux target by writing a motd bash script triggered with root privileges...

CVE-2024-9007

creationtimestamp| type| source ---|---|--- 2024-09-20 02:11:42+00:00| seen| https://t.me/cvedetector/6084 2025-07-16 13:28:47+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-9007.yaml 2025-07-17 21:02:28+00:00| seen|...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.37 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.37 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

[SECURITY] Fedora 41 Update: python3.12-3.12.6-1.fc41

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

CGA-2C8W-H4PJ-CJ9G

Bulletin has no description...

CVE-2023-279970

creationtimestamp| type| source ---|---|--- 2024-09-16 19:13:31+00:00| seen| MISP/aaf97b2c-ad16-4ce6-928a-a440112d0fd3...

[SECURITY] Fedora 41 Update: python3-docs-3.13.0~rc2-1.fc41

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

CVE-2024-46958

In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files between the server and client may become world writable or world readable. This is fixed in 3.13.4...

[SECURITY] Fedora 40 Update: python3-docs-3.12.6-1.fc40

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

Metasploit Weekly Wrap-Up 09/13/2024

SPIP Modules This week brings more modules targeting the SPIP publishing platform. SPIP has gained some attention from Metasploit community contributors recently and has inspired some PHP payload and encoder improvements. New module content 2 SPIP BigUp Plugin Unauthenticated RCE Authors: Julien...

Untrusted Query Object Evaluation in RPC API

During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...

CGA-VJ3W-HJ9V-3R8W

Bulletin has no description...

D-Tale vulnerable to Remote Code Execution through the Query input on Chart Builder

Impact Users hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server. Patches Users should upgrade to version 3.14.1 where the "Custom Filter" input is turned off by default. You can find out more information on how to turn it back...

GHSA-9XCG-3Q8V-7FQ6 gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property

This report concerns the Groth16 prover when used with commitments as in frontend.Committer. To simplify exposition of the issue, I will focus on the case of a single commitment, to only private witnesses. But the issue should be present whenever commitments are used that include private witnesse...

gnark commitments to private witnesses in Groth16 as implemented break zero-knowledge property

This report concerns the Groth16 prover when used with commitments as in frontend.Committer. To simplify exposition of the issue, I will focus on the case of a single commitment, to only private witnesses. But the issue should be present whenever commitments are used that include private witnesse...