USN-7072-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Watchdog drivers; - Netfilter; - Network traffic control; CVE-2024-38630, CVE-2024-27397, CVE-2024-45016...

CVE-2024-4211

Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels. Multiple missing permission checks - ALM job config has been discovered in OpenText Application Automation...

CVE-2024-47945

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The session IDs are predictable, with only 32,768 possible values per user, which allows attackers to pre-generate valid session IDs, leading to unauthorized access to user sessions...

CVE-2024-9904

creationtimestamp| type| source ---|---|--- 2024-10-13 04:42:24+00:00| seen| https://t.me/cvedetector/7777 2024-10-13 14:10:43+00:00| seen| https://t.me/HackerArsenal/546...

[SECURITY] [DLA 3916-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3916-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 12, 2024 https://wiki.debian.org/LTS -...

CVE-2020-1456

creationtimestamp| type| source ---|---|--- 2024-10-09 19:59:05+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2518 2025-03-02 11:46:28+00:00| seen| Telegram/Km9gcRJ-PStd5h4tHMmt4rQnkSox9bnmGNHQu1h5QIrVDU9 2025-03-02 11:46:28+00:00| seen|...

Improper Ownership Management

Overview Affected versions of this package are vulnerable to Improper Ownership Management due to the storage and comparison of local actor IDs in the database. An attacker can impersonate another user and manipulate import requests by exploiting coinciding actor IDs across different wikis. Note:...

net-snmp: Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously

A flaw was found in net-snmp. This issue occurs due to improper input validation when simultaneously setting malformed OIDs in the master agent and subagent...

CLSA-2024-1728478342 Fix of 5 CVEs

New microcode update packages from upstream up to 2024-08-13: - Updated microcodes: sig 0x00050657, pfmask 0xbf, 2024-03-01, rev 0x5003707, size 39936 sig 0x0005065b, pfmask 0xbf, 2024-04-01, rev 0x7002904, size 30720 sig 0x000606a6, pfmask 0x87, 2024-04-01, rev 0xd0003e7, size 308224 sig...

SUSE: Security Advisory (SUSE-SU-2024:3540-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS by a hash flooding attack, due to inefficient array processing when handling URI parts. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

CVE-2024-37976

creationtimestamp| type| source ---|---|--- 2024-10-08 17:54:47+00:00| seen| https://www.thezdi.com/blog/2024/10/8/the-october-2024-security-update-review...

Mecha CMS security vulnerabilities

Mecha CMS is a Mecha open source flat file content management system for minimalists. A security vulnerability exists in Mecha CMS version 3.0.0 that stems from vulnerability to directory traversal attacks. An attacker can construct cookies and URIs that bypass user identity checks and then pass...

[SECURITY] [DSA 5783-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5783-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 04, 2024 https://www.debian.org/security/faq -...

PT-2024-32710 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: This issue exists due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this by including multiple userid...

CLSA-2024-1727817758 Fix of 74 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-26752 - l2tp: pass correct message length to ip6appenddata CVE-url: https://ubuntu.com/security/CVE-2021-47188 - scsi: ufs: core: Improve SCSI abort handling CVE-url: https://ubuntu.com/security/CVE-2024-26677 - rxrpc: Fix delayed ACKs to not set the...

USN-7003-5: Linux kernel vulnerabilities

It was discovered that the JFS file system contained an out-of-bounds read vulnerability when printing xattr debug information. A local attacker could use this to cause a denial of service system crash. CVE-2024-40902 Several security issues were discovered in the Linux kernel. An attacker could...

nginx: Multiple Vulnerabilities

Background nginx is a robust, small, and high performance HTTP and reverse proxy server. Description Multiple vulnerabilities have been discovered in nginx. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround...

IcedTea: Multiple Vulnerabilities

Background IcedTea’s aim is to provide OpenJDK in a form suitable for easy configuration, compilation and distribution with the primary goal of allowing inclusion in GNU/Linux distributions. Description Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers...

CVE-2024-46097

TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...