[SECURITY] Fedora 39 Update: python-pillow-10.3.0-1.fc39

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...

CVE-2024-3524

A vulnerability, which was classified as problematic, has been found in Campcodes Online Event Management System 1.0. This issue affects some unknown processing of the file /views/process.php. The manipulation of the argument name leads to cross site scripting. The attack may be initiated remotel...

UBUNTU-CVE-2024-3120

A stack-buffer overflow vulnerability exists in all versions of sngrep since v1.4.1. The flaw is due to inadequate bounds checking when copying 'Content-Length' and 'Warning' headers into fixed-size buffers in the sipvalidatepacket and sipparseextraheaders functions within src/sip.c. This...

PT-2024-5063 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 20.4R3-S9 Junos OS versions from 21.2 prior to 21.2R3-S7 Junos OS versions from 21.3 prior to 21.3R3-S5 Junos OS versions from 21.4 prior to 21.4R3-S4 Junos OS versions from 22.1 prior to 22.1R3-S4 Junos OS versions...

PT-2024-2939 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions 22.1 before 22.1R1-S2, 22.1R2 Junos OS Evolved versions 22.1 before 22.1R1-S2-EVO, 22.1R2-EVO Description: The issue is related to an Improper Check for Unusual or Exceptional Conditions vulnerability in the telemetry...

PT-2024-21279 · Unknown · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms versions prior to 3.8.1 Description: The issue is related to a cross-site scripting vulnerability in submit processing. If exploited, an arbitrary script may be executed on the web browser of the user accessing the website using t...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in versions prior to Google Chrome 123.0.6312.122, which originated from a vulnerability that allows remote attackers to corrupt GPU processes and perform sandbox escapes via specific UI gesture...

The software for remote control of computers by TeamViewer on macOS has vulnerabilities related to error handling of links, which allows attackers to escalate their privileges or cause service failures.

The vulnerability of TeamViewer’s remote control software for macOS is related to errors in URL processing. Exploiting this vulnerability can allow attackers to gain increased privileges or cause service interruptions...

The vulnerability of the Meeting Chat component of Zoom’s video conferencing software, which allows a intruder to disclose protected information

The vulnerability of the Zoom software’s meeting chat component relates to the improper processing of logical operations. Exploiting this vulnerability allows a malicious actor to disclose protected information remotely...

The vulnerability in the implementation of the NETCONF protocol for Cisco IOS XE allows a attacker to elevate their privileges to the root level.

The vulnerability of the NETCONF protocol implementation in Cisco IOS XE operating systems is related to the use of an incomplete blacklist when processing input data. Exploiting this vulnerability allows a malicious actor to elevate their privileges to the root level...

ROS-20240410-17

The vulnerability of the ImageBuild function of the Moby containerization software tool is related to a flaw in the data source validation mechanism for endpoint processing. is related to a flaw in the data source validation mechanism for endpoint processing. Exploitation of the vulnerability cou...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.2 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security...

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.

...

CVE-2024-30214

The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script could be processed on client side...

CVE-2024-30214 Cross-Site Scripting (XSS) vulnerability in SAP Business Connector

The application allows a high privilege attacker to append a malicious GET query parameter to Service invocations, which are reflected in the server response. Under certain circumstances, if the parameter contains a JavaScript, the script could be processed on client side...

PT-2024-23575 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions 2 Description: A remote code execution issue exists due to an OS command injection vulnerability in the command processing or system call components of ROS2, including External Command Execution Modules, Syst...

PT-2024-26403 · Unknown · Campcodes Online Event Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Event Management System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file /views/process.php. The manipulation of the name argument leads to cross-site scripting...

A flaw was found in Ceph relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW causing a denial of service.

...

CVE-2024-3432

A vulnerability was found in PuneethReddyHC Event Management 1.0. It has been rated as critical. This issue affects some unknown processing of the file /backend/register.php. The manipulation of the argument eventid/fullname/email/mobile/college/branch leads to sql injection. The attack may be...

Trust Boundary Violation

emacs is vulnerable to Trust Boundary Violation. The vulnerability is due to a flaw in the processing logic of Emacs Gnus, allows attackers to potentially exploit trust assumptions in Emacs Gnus, as it incorrectly treats inline MIME contents as trusted without appropriate validation...