766 matches found
GitLab 10.6 < 13.8.7 / 13.9 < 13.9.5 / 13.10 < 13.10.1 (CVE-2021-22197)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target...
GitLab 12.2 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22251)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with email address domain that should be blocked by group settings...
GitLab 10.6 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39898)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the project which it was exported from. CVE-2021-39898 Note that...
GitLab 7.11.0 < 14.1.7 (CVE-2021-39879)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable two-factor authentication CVE-2021-39879 Note that Nessus ha...
PT-2023-36300 · Suse · Container-Suseconnect
Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...
PSA: Critical POP Chain Allowing Remote Code Execution Patched in WordPress 6.4.2
WordPress 6.4.2 was released today, on December 6, 2023. It includes a patch for a POP chain introduced in version 6.4 that, combined with a separate Object Injection vulnerability, could result in a Critical-Severity vulnerability allowing attackers to execute arbitrary PHP code on the site. We...
SUSE-SU-2023:4511-1 Security update for container-suseconnect
This update of container-suseconnect fixes the following issues: - rebuild the package with the go 1.21 security release bsc1212475...
PT-2023-36290 · Suse · Container-Suseconnect
Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...
GitLab 14.7 < 16.3.6 / 16.4.0 < 16.4.2 / 16.5.0 < 16.5.1 (CVE-2023-4700)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments,...
SUSE-SU-2023:4357-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container
This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: kubevirt is rebuilt against the current GO security release. - Set cache mode on hotplugge...
Updated nodejs packages fix security vulnerabilities
This is a security release. The following CVEs are fixed in this release: CVE-2023-44487: nghttp2 Security Release High CVE-2023-45143: undici Security Release High CVE-2023-38552: Integrity checks according to policies can be circumvented Medium CVE-2023-39333: Code injection via WebAssembly...
SUSE-SU-2023:4125-1 Security update for container-suseconnect
This update of container-suseconnect fixes the following issues: - rebuild the package with the go 1.21 security release bsc1212475...
PT-2023-36283 · Suse · Container-Suseconnect
Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...
SUSE-SU-2023:3952-2 Security update for runc
This update of runc fixes the following issues: - Update to runc v1.1.8. Upstream changelog is available from . - rebuild the package with the go 1.21 security release bsc1212475...
PT-2023-36273 · Runc · Runc
Name of the Vulnerable Software and Affected Versions: runc versions prior to 1.1.8 Description: The issue is related to the runc package, which has been updated to version 1.1.8. The update includes a rebuild of the package with the go 1.21 security release. Recommendations: For versions prior t...
PT-2023-36280 · Buildah +1 · Buildah +1
Name of the Vulnerable Software and Affected Versions: buildah affected versions not specified Description: The issue is related to a security release in go 1.21. The problem is addressed by rebuilding the package with this security release. Recommendations: At the moment, there is no information...
mantis -- multiple vulnerabilities
Mantis 2.25.8 release reports: Security and maintenance release 0032432: Update guzzlehttp/psr7 to 1.9.1 CVE-2023-29197 0032981: Information Leakage on DokuWiki Integration CVE-2023-44394...
PT-2023-36279 · Cni +1 · Cni +1
Name of the Vulnerable Software and Affected Versions: cni affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The estimated number of potentially affected devices worldwide is not available. There is no information...
Samba AD DC password exposure to privileged
Description In normal operation, passwords and most secrets are never disclosed over LDAP in Active Directory. However, due to a design flaw in Samba's implementation of the DirSync control, Active Directory accounts authorized to do some replication, but not to replicate sensitive attributes, ca...