io.debezium:debezium-connector-mongodb (0.10.0.beta2), io.debezium:debezium-connector-mysql (0.10.0.beta2) +5 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (0.10.0.beta2)

io.debezium:debezium-core MAVEN version 0.10.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connector-mongodb 0.10.0.beta2 - io.debezium:debezium-connector-mysql 0.10.0.beta...

io.debezium:debezium-connect-rest-extension (1.9.1.final), io.debezium:debezium-connector-db2 (1.9.1.final) +36 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.9.1.final)

io.debezium:debezium-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connect-rest-extension 1.9.1.final - io.debezium:debezium-connector-db2 1.9.1.fina...

io.debezium:debezium-connector-mongodb (0.7.1), io.debezium:debezium-connector-mysql (0.7.1) +2 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (0.7.1)

io.debezium:debezium-core MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connector-mongodb 0.7.1 - io.debezium:debezium-connector-mysql 0.7.1 -...

io.debezium:debezium-connector-mongodb (0.9.0.alpha1), io.debezium:debezium-connector-mysql (0.9.0.alpha1) +4 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (0.9.0.alpha1)

io.debezium:debezium-core MAVEN version 0.9.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connector-mongodb 0.9.0.alpha1 - io.debezium:debezium-connector-mysql 0.9.0.alpha...

io.debezium:debezium-connector-mongodb (0.9.0.final), io.debezium:debezium-connector-mysql (0.9.0.final) +4 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (0.9.0.final)

io.debezium:debezium-core MAVEN version 0.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connector-mongodb 0.9.0.final - io.debezium:debezium-connector-mysql 0.9.0.final -...

io.undertow:undertow-servlet (1.0.0.cr5), io.undertow:undertow-websockets-jsr (1.0.0.cr5) +2 more potentially affected by CVE-2023-4639 via io.undertow:undertow-core (1.0.0.cr5)

io.undertow:undertow-core MAVEN version 1.0.0.cr5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.cr5 - io.undertow:undertow-websockets-jsr 1.0.0.cr5 -...

CVE-2024-52515 Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended...

CoolType font processing framework Acrobat Reader Disclosure

The vulnerability of the CoolType font processing framework in Acrobat Reader software, which is used for reading and editing PDF files, involves reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose protected information through a...

CVE-2024-48966 Life2000 service tools for test and calibration do not support user authentication

The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedde...

WebKitGTK WPE Buffer Overflow DoS

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the escape of operations beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

Baxter Life2000 Access Control Vulnerability

The Baxter Life2000 is a mask-less non-invasive ventilator from Baxter. An access control error vulnerability exists in Baxter Life2000 version 06.08.00.00 and prior, which stems from unsupported user authentication, allowing an attacker to obtain diagnostic information or manipulate device...

Boa path traversal vulnerability

Boa is a Boa open source open source code for embedded applications. A path traversal vulnerability exists in Boa that stems from a pathname being incorrectly restricted to a restricted directory...

CVE-2024-52305

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...

CVE-2024-52305 UnoPim Stored XSS : Cookie hijacking through Create User function

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...

CVE-2024-52305

CVE-2024-52305 affects UnoPim (Laravel). The issue resides in the Create User flow, where uploading a profile image (notably SVG) can execute embedded scripts, enabling a stored XSS that can steal cookies and potentially hijack sessions. Affected versions include the UnoPim releases prior to the ...

kernel: ACPI: EC: Fix oops when removing custom query handlers

A flaw was found in the Linux kernel's ACPI Embedded Controller EC subsystem. When removing custom query handlers, a kernel oops can occur if the handler is still being executed in the EC query workqueue while the module containing the callback function is being unloaded. The fix ensures the...

kernel: clk: tegra: tegra124-emc: Fix potential memory leak

In the Linux kernel, the following vulnerability has been resolved: clk: tegra: tegra124-emc: Fix potential memory leak The tegra and tegra needs to be freed in the error handling path, otherwise it will be leaked...

November 12, 2024—KB5046682 (Monthly Rollup)

None None...

November 12, 2024—KB5046687 (Monthly Rollup)

None None...

SUSE CVE-2024-10524

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host...