Rebuilding a run with revoked script approval allowed by workflow-cps

workflow-cps 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3, does not check whether the main Jenkinsfile script for a rebuilt build is approved. This allows attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approved. NOTE: This...

CVE-2024-52550: Improper Validation of Integrity Check Value

Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main Jenkinsfile script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose Jenkinsfile script is no longer approv...

Security update for python-wxPython

This update for python-wxPython fixes the following issues: Security issue fixed: CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XMLResumeParser function bsc1232590. Non-security issues fixed: rebuilt for python 3.11 bsc1228252. add repack script, do not include packaging/ d...

Low: Red Hat Bug Fix Advisory: updated el9/flatpak-sdk container image

Updated el9/flatpak-sdk container image is now available for Red Hat Enterprise Linux 9. The el9/flatpak-sdk container image has been updated for Red Hat Enterprise Linux 9 to address the following security advisory: RHSA-2024:8617 see References Users of el9/flatpak-sdk container images are...

virt:kvm_utils1 security update

hivex 1.3.18-21 - Bounds check for block exceeding page length CVE-2021-3504 resolves: rhbz1950501 1.3.18 - Resolves: bz1810193 Upgrade components in virt:rhel module:stream for RHEL-8.3 release 1.3.18 - Resolves: bz1810193 Upgrade components in virt:rhel module:stream for RHEL-8.3 release 1.3.15...

SUSE CVE-2024-50042

In the Linux kernel, the following vulnerability has been resolved: ice: Fix increasing MSI-X on VF Increasing MSI-X value on a VF leads to invalid memory operations. This is caused by not reallocating some arrays. Reproducer: modprobe ice echo 0 /sys/bus/pci/devices/$PFPCI/sriovdriversautoprobe...

DEBIAN-CVE-2024-50042

In the Linux kernel, the following vulnerability has been resolved: ice: Fix increasing MSI-X on VF Increasing MSI-X value on a VF leads to invalid memory operations. This is caused by not reallocating some arrays. Reproducer: modprobe ice echo 0 /sys/bus/pci/devices/$PFPCI/sriovdriversautoprobe...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

WordPress plugin WPIDE 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...

VM images built with Image Builder and Proxmox provider use default credentials

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the image build process. Additionally, virtual machine images built using the Proxmox provider do not disable these default...

SUSE-SU-2024:3458-1 Security update for kubernetes1.24

This update of kubernetes1.24 fixes the following issues: - rebuild the package with the current go 1.23 security release bsc1229122...

SUSE-SU-2024:3454-1 Security update for kubernetes1.28

This update of kubernetes1.28 fixes the following issues: - rebuild the package with the current go 1.23 security release bsc1229122...

CVE-2024-46765

In the Linux kernel, the following vulnerability has been resolved: ice: protect XDP configuration with a mutex The main threat to data consistency in icexdp is a possible asynchronous PF reset. It can be triggered by a user or by TX timeout handler. XDP setup and PF reset code access the same...

WordPress Plugin "Forminator" vulnerable to cross-site scripting

Overview WordPress Plugin "Forminator" provided by WPMU DEV assists building web forms. When accessing the page including the web form created with Forminator, some information from the URL may be embedded to the web form. This feature processes the embedded information improperly, leading to...

JVN#65724976: WordPress Plugin "Forminator" vulnerable to cross-site scripting

WordPress Plugin "Forminator" provided by WPMU DEV assists building web forms. When accessing the page including the web form created with Forminator, some information from the URL may be embedded to the web form. This feature processes the embedded information improperly, leading to cross-site...

SUSE-SU-2024:3144-1 Security update for hdf5, netcdf, trilinos

This update for hdf5, netcdf, trilinos fixes the following issues: hdf5 was updated from version 1.10.8 to 1.10.11: - Security issues fixed: CVE-2019-8396: Fixed problems with malformed HDF5 files where content does not match expected size. bsc1125882 CVE-2018-11202: Fixed that a malformed file...

buildah security update

1.33.7-4.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.33.7-4 - rebuild for CVE-2024-24783 - Resolves: RHEL-28428...

Moderate: Red Hat Bug Fix Advisory: updated RHDH-1.1-RHEL-9 container images

Updated RHDH-1.1-RHEL-9 container images are now available The RHDH-1.1-RHEL-9 container images have been updated to address the following security advisory: RHSA-2024:5529 see References Users of RHDH-1.1-RHEL-9 container images are advised to upgrade to these updated images, which contain...

PT-2024-32180

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.52 Description The main threat to data consistency in ice xdp is a possible asynchronous PF reset, which can be triggered by a user or by TX timeout handler. XDP setup and PF reset code access the same...

PT-2024-6911

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.0-rc2+ Description The vulnerability is related to the netif queue set napi function in the Linux kernel, which can lead to out-of-bounds writes when XDP queues are included. This issue arises because netif...