Security Bulletin: IBM Storage Ceph is vulnerable to an Infinite Loop in Grafana (CVE-2024-24786)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. CVE-2024-24786 This bulletin identifies the steps to take to address the vulnerability in Grafana. Vulnerability Details CVEID:CVE-2024-24786 DESCRIPTION: The protojson.Unmarshal function can enter an infinite loop when...

Fedora 42 : pgadmin4 (2025-3c80b660e0)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-3c80b660e0 advisory. Update to pgadmin-9.8. Fixes CVE-2025-9636. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

Oracle Linux 8 : redis (ELSA-2025-20656)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-20656 advisory. 6.2.9-1.0.2 - Fix for CVE-2025-49844 Orabug: 38515582 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Fedora 41 : insight (2025-d22287ec14)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-d22287ec14 advisory. Fix CVS 2025-11082 and 2025-11083. + conditional for explicit BR tcl/tk 8 + dummy rpm check section. Tenable has extracted the preceding description...

AlmaLinux 10 : mysql-selinux and mysql8.4 (ALSA-2025:15699)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:15699 advisory. openssl: Timing side-channel in ECDSA signature computation CVE-2024-13176 mysql: mysqldump unspecified vulnerability CPU Apr 2025 CVE-2025-30722 mysql:...

SUSE CVE-2022-50526

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork:...

Important: Red Hat Security Advisory: Satellite 6.15.5.5 Async Update

An update is now available for Red Hat Satellite 6.15 for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

open-vm-tools security update

An update is available for open-vm-tools. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Open Virtual Machine Tools are the open source implementation of th...

CVE-2025-61788

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs metadata like title, description, etc. unfiltered and unmodified. The vulnerability allows attackers to...

CVE-2025-61906

Opencast versions prior to 17.8 and 18.2 have a flaw where the editor may publish a video without notifying the user, potentially exposing internal media. The vulnerability requires a user with write access to an event who uses the editor and first clicks Save & Publish, then Save. Impact is desc...

CVE-2025-61906 Opencast's editor accidentally publishes videos/overwrites publications #1626

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for...

CVE-2025-61906 Opencast's editor accidentally publishes videos/overwrites publications #1626

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for...

UK Police Arrest Two Teens Over Kido Nursery Ransomware Attack

Met Police arrested two teenagers over the Kido nursery ransomware attack, which exposed data for 8,000 children. Full details on the hack and police investigation...

BIT-REDIS-2025-46819 Redis is vulnerable to DoS via specially crafted LUA scripts

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted LUA script to read out-of-bound data or crash the server and subsequent denial of service. The problem exists in all versions of Redis with Lua...

Oracle Linux 8 : open-vm-tools (ELSA-2025-17509)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-17509 advisory. - Resolves: RHEL-117388 CISA Major Incident CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools rhel-8.10.z Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2025-59732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When decoding an OpenEXR file that uses DWAA or DWAB compression, there's an implicit assumption that the height and width are divisible by 8. If the height or...

Linux Distros Unpatched Vulnerability : CVE-2022-50437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/msm/hdmi: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized...

Linux Distros Unpatched Vulnerability : CVE-2025-59728

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When calculating the content path in handling of MPEG-DASH manifests, there's an out-of-bounds NUL-byte write one byte past the end of the buffer.When we call...

Linux Distros Unpatched Vulnerability : CVE-2025-59149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. In version 8.0.0, rules usi...

Linux Distros Unpatched Vulnerability : CVE-2025-59730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When decoding a frame for a SANM file ANIM v0 variant, the decoded data can be larger than the buffer allocated for it. Frames encoded with codec 48 can specify...