ALSA-2024:1818 Moderate: java-1.8.0-openjdk security update

The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fixes: OpenJDK: long Exception message leading to crash 8319851 CVE-2024-21011 OpenJDK: integer overflow in C1 compiler address generation 8322122 CVE-2024-2106...

CVE-2024-26894 ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()

In the Linux kernel, the following vulnerability has been resolved: ACPI: processoridle: Fix memory leak in acpiprocessorpowerexit After unregistering the CPU idle device, the memory associated with it is not freed, leading to a memory leak: unreferenced object 0xffff896282f6c000 size 1024: comm...

GHSA-G7XQ-XV8C-H98C Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

Summary There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. Our filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an tag could be bypassed with tab \t or newline \n characters between the...

Important: emacs

Issue Overview: In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. CVE-2024-30202 Affected Packages: emacs Issue Correction: Run dnf update emacs --releasever 2023.4.20240416 to update your system. New Packages: aarch64: ...

A new tool bar has appearred since Citrix Workspace App for ChromeOS 2402.

A new tool bar has appearred after upgrading to Citrix Workspace App for ChromeOS 2402. Prior to 2402, the old old tool bar was displayed...

PT-2024-3086 · Google +6 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 124.0.6367.60 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Autofill feature, allowing an attacker to perform UI spoofing via a craft...

DSA-5655-2 cockpit - regression update

Bulletin has no description...

PT-2024-3194 · Mysql Server · Mysql Connectors

Name of the Vulnerable Software and Affected Versions: MySQL Connectors versions 8.3.0 and prior Description: The issue is related to insufficient input validation in the Connector/Python component of MySQL Connectors, allowing an unauthenticated attacker with network access via multiple protocol...

PT-2024-3077 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 124.0.6367.60 Description: The issue is related to insufficient data validation in the Browser Switcher component, which can be exploited by a remote attacker to inject scripts or HTML into a privileged page vi...

CVE-2023-47626 iTop vulnerable to XSS vulnerability in authent-token

iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1...

PT-2024-18193 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: The issue is related to insufficient protection over sensitive endpoints, allowing unauthorized access when the application is bound to a specific interface. This is due to th...

PT-2024-3034 · Unknown +1 · Kv Replay Viewer +2

Name of the Vulnerable Software and Affected Versions: KV STUDIO versions 11.64 and earlier KV REPLAY VIEWER versions 2.64 and earlier VT5-WX15/WX12 versions 6.02 and earlier Description: An out-of-bounds read issue exists, which may lead to information disclosure or arbitrary code execution by...

HPESBNW04575 rev.1 - HPE Telco IP Mediation E-Media, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Buffer Overflow; Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE TeMIP - Prior to 8.5.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2023-36478 |...

PT-2024-17910 · WordPress · Smart Forms

Name of the Vulnerable Software and Affected Versions: The Smart Forms WordPress plugin versions prior to 2.6.94 Description: The issue is related to the lack of CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as...

MGASA-2024-0125 Updated xfig packages fix security vulnerability

Xfig v3.2.8 was discovered to contain a NULL pointer dereference when calling XGetWMHints. CVE-2023-45920...

SUSE-SU-2024:1278-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005549 fixes one issue. The following security issue was fixed: - CVE-2023-52340: Fixed ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU bsc1219296...

Palo Alto Networks Releases Guidance for Vulnerability in PAN-OS, CVE-2024-3400

Palo Alto Networks has released workaround guidance for a command injection vulnerability CVE-2024-3400 affecting PAN-OS versions 10.2, 11.0, and 11.1. Palo Alto Networks has reported active exploitation of this vulnerability in the wild. CISA encourages users and administrators to review the Pal...

SUSE-RU-2024:1202-1 Recommended update for libzypp, zypper, PackageKit

This update for libzypp, zypper, PackageKit fixes the following issues: - Fixup New VendorSupportOption flag VendorSupportSuperseded jscOBS-301, jscPED-8014 - CVE-2024-0217: Check that Finished signal is emitted at most once bsc1218544 - Add resolver option 'removeOrphaned' for distupgrade...

Sticky Buttons < 3.2.4 - Button Deletion via CSRF

Description The plugin does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks PoC Make a logged in admin open an HTML file where ID is a valid ID: action...

Security update for sngrep (moderate)

openSUSE Security Update: Security update for sngrep Announcement ID: openSUSE-SU-2024:0106-1 Rating: moderate References: Cross-References: CVE-2024-3119 CVE-2024-3120 Affected Products: openSUSE Backports SLE-15-SP5 An update that fixes two vulnerabilities is now available. Description: This...