CVE-2024-37619

StrongShop v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the specgroupid parameter at /spec/index.blade.php...

CVE-2024-37619: Improper Neutralization of Input During Web Page Generation

StrongShop v1.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the specgroupid parameter at /spec/index.blade.php...

OPENSUSE-SU-2024:11247-1 python36-openapi-spec-validator-0.2.9-1.5 on GA media

These are all security issues fixed in the python36-openapi-spec-validator-0.2.9-1.5 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 9 : cockpit (ELSA-2024-3843)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3843 advisory. 311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

CVE-2024-5699

Mozilla Firefox versions earlier than 127 are vulnerable to a security bypass due to the incorrect handling of cookie prefixes like __Secure. The browser failed to perform a case-insensitive comparison as required by the specification, causing it to ignore prefixes that were not correctly capital...

CVE-2024-5699

In violation of spec, cookie prefixes such as Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This...

cockpit security update

311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110 - Remove duplicate reference to server in cockpit Orabug: 34030494 - Update documentation links Orabug: 30271413, Orabug: 32013095,...

Malicious code in mapbox-demo-gl-style-spec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa5a509685be972fc15ceb454b2c3768fd8dd7c5162f11471642ab34e1f34fb9 The OpenSSF Package Analysis project identified 'mapbox-demo-gl-style-spec' @ 14.4.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-1539 Malicious code in mapbox-demo-gl-style-spec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fa5a509685be972fc15ceb454b2c3768fd8dd7c5162f11471642ab34e1f34fb9 The OpenSSF Package Analysis project identified 'mapbox-demo-gl-style-spec' @ 14.4.0 npm as malicious. It is considered malicious because: - The...

RHEL 8 : cri-o (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull CVE-2020-8945 - The OCI...

CVE-2024-35219 OpenAPI Generator Online - Arbitrary File Read/Delete

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary,...

python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is...

python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is...

JAW - A Graph-based Security Analysis Framework For Client-side JavaScript

An open-source, prototype implementation of property graphs for JavaScript based on the esprima parser, and the EsTree SpiderMonkey Spec. JAW can be used for analyzing the client-side of web applications and JavaScript-based programs. This project is licensed under GNU AFFERO GENERAL PUBLIC LICEN...

CVE-2024-35825 usb: gadget: ncm: Fix handling of zero block length packets

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling of zero block length packets While connecting to a Linux host with CDCNCMNTBDEFSIZETX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometim...

CVE-2022-48704 drm/radeon: add a force flush to delay work when radeon

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: add a force flush to delay work when radeon Although radeon card fence and wait for gpu to finish processing current batch rings, there is still a corner case that radeon lockup work queue may not be fully flushed, an...

[SECURITY] Fedora 38 Update: matrix-synapse-1.105.1-1.fc38

Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...