firefox: Clickjacking the registerProtocolHandler info-bar Reporter

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A web page could trick a user into setting that site as the default handler for a custom URL protocol...

firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effo...

firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume...

The vulnerability of the Qnap network device support automation system is related to errors in the authentication process. This error allows a malicious user to gain unauthorized access to the device.

The vulnerability of the Qnap network device support automation system is related to errors in the authentication process for certificates. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the device remotely...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to a flaw in the default filtering mechanism that only blocks headers starting with specific prefixes. An attacker can manipulate header entries to invoke arbitrary methods from the Bean registr...

CVE-2025-24796

Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within a jail and is allowed to download content from locations...

CVE-2025-24796

Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within a jail and is allowed to download content from locations...

CVE-2025-24796 Remote Code Execution within Collabora Online jail with Macros Enabled

Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within a jail and is allowed to download content from locations...

CVE-2025-24796

CVE-2025-24796 affects Collabora Online. When macros are enabled, Collabora Online can download and execute arbitrarily provided binaries inside the jail, potentially bypassing network access restrictions and allowing code execution within the document‑hosted environment. The issue is mitigated b...

SUSE-RU-2025:0800-1 Recommended update for python3-M2Crypto

This update for python3-M2Crypto fixes the following issues: - Fix spelling of BSD-2-Clause license. - Update to 0.44.0: - The real license is BSD 2-Clause, not MIT. - Remove python-M2Crypto.keyring, because PyPI broke GPG support - Build for modern python stack on SLE/Leap - require setuptools -...

BIT-NGINX-2025-1695 NGINX Unit Java Vulnerability

In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resource utilization. This vulnerability allows a remote attacker to cause a degradation that can lead to a limited denial-of-service DoS. There...

GHSA-RFH6-9R2Q-98VF Jenkins reveals encrypted values of secrets stored in agent configuration to users with Agent/Extended Read permission

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI. This allows attackers with View/Read permission to view encrypted values of secrets. Jenkins 2.500, LTS 2.492.2 redacts the encrypted values of...

Linux Distros Unpatched Vulnerability : CVE-2024-45778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash. CVE-2024-4577...

Linux Distros Unpatched Vulnerability : CVE-2024-56639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: hsr: must allocate more bytes for RedBox support Blamed commit forgot to change hsrinitskb to allocate larger skb for RedBox case. Indeed,...

Linux Distros Unpatched Vulnerability : CVE-2025-21682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - eth: bnxt: always recalculate features after XDP clearing, fix null-deref Recalculate features when XDP is detached. Before: ip li set dev eth0 xdp obj...

SUSE-SU-2025:20135-1 Security update for glibc

This update for glibc fixes the following issues: - CVE-2025-0395: Fixed buffer overflow in the assert function bsc1236282. Other fixes: - Fix underallocation of abortmsgs struct - Correctly determine livepatching support - Remove nss-systemd from default nsswitch.conf bsc1233699...

Security update for glibc

This update for glibc fixes the following issues: CVE-2025-0395: Fixed buffer overflow in the assert function bsc1236282. Other fixes: - Fix underallocation of abortmsgs struct - Correctly determine livepatching support - Remove nss-systemd from default nsswitch.conf bsc1233699 Patch...

CVE-2025-26589

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Cristopher Dino IE CSS3 Support ie-css3-support allows Reflected XSS.This issue affects IE CSS3 Support: from n/a through = 2.0.1...

SUSE CVE-2025-1938

Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firef...

Linux Distros Unpatched Vulnerability : CVE-2022-44840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow vulnerability in binutils readelf before 2.40 via function findsectioninset in file readelf.c. CVE-2022-44840 Note that Nessus relies on th...