SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2024:3986-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3986-1 advisory. The SUSE Linux Enterprise 15 SP6 RT kernel was updated to receive various security bugfixes. The following security bugs were...

Fedora 37 : curl (2022-e9d65906c4)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e9d65906c4 advisory. - url: use IDN decoded names for HSTS checks CVE-2022-42916 - httpproxy: restore the protocol pointer on error CVE-2022-42915 - netrc: replace fgets...

Fedora 37 : xen (2022-9f51d13fa3)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-9f51d13fa3 advisory. x86: Multiple speculative security issues XSA-422, CVE-2022-23824 ---- x86: unintended memory sharing between guests XSA-412, CVE-2022-42327 Xenstor...

Fedora 41 : firefox (2024-24fbd327e3)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-24fbd327e3 advisory. - New upstream update 132.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

CVE-2024-52295

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2...

Session Fixation

Apache Kylin is vulnerable to Session Fixation. The vulnerability is due to improper handling of session identifiers, allowing an attacker to hijack a user's session...

OvrC Platform Vulnerabilities Expose IoT Devices to Remote Attacks and Code Execution

A security analysis of the OvrC cloud platform has uncovered 10 vulnerabilities that could be chained to allow potential attackers to execute code remotely on connected devices. "Attackers successfully exploiting these vulnerabilities can access, control, and disrupt devices supported by OvrC; so...

CVE-2024-52299: Generation of Predictable Numbers or Identifiers

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest...

PT-2024-35161 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.2 Description: The issue allows attackers to forge JWT and take over services due to the JWT secret being hardcoded in the code. Additionally, the UID and OID are also hardcoded. This has been fixed in version...

Intel VTune Profiler Advisory - Lenovo Support US

No description provided...

Intel Graphics Compiler and Intel Arc Pro Graphics Advisory - Lenovo Support US

No description provided...

Intel VROC Software Advisory - Lenovo Support US

No description provided...

Multi-vendor BIOS Security Vulnerabilities (November, 2024) - Lenovo Support US

No description provided...

Security Updates for Microsoft Excel Products (November 2024)

The Microsoft Excel Products are missing a security update. They are, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2024-49026, CVE-2024-49027,...

LibOSDP code-related vulnerabilities

LibOSDP is a goToMain open source cross-platform open source implementation of the IEC 60839-11-5 Open Surveillance Device Protocol. Designed to improve interoperability between access control and security products. A code issue vulnerability exists in LibOSDP versions prior to 2.4.0 that stems...

KB5046618: Windows Server version 23H2 Security Update (November 2024)

The remote Windows host is missing security update 5046618. It is, therefore, affected by multiple vulnerabilities - Windows Kerberos Remote Code Execution Vulnerability CVE-2024-43639 - Windows NT OS Kernel Elevation of Privilege Vulnerability CVE-2024-43623 - Windows Telephony Service Elevation...

Mars: unauthorized access and add user and change personal information all users

The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of...

SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2024:3911-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3911-1 advisory. Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z jscPED-11136 - Go CVE Numbering Authority IDs added or updated with...

PT-2024-7682 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.5.0 through 10.0.16 Description: The issue is related to incorrect session management in the GLPI system, which can allow a remote attacker to gain full access to the application by intercepting a session. An unauthenticated...

Photon OS 5.0: Linux PHSA-2024-5.0-0391

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0391. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...