edk2 bug fix and enhancement update

An update is available for edk2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

Debian dla-3908 : debian-security-support - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3908 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3908-1 [email protected] https://www.debian.org/lts/security/...

IcedTea: Multiple Vulnerabilities

Background IcedTea’s aim is to provide OpenJDK in a form suitable for easy configuration, compilation and distribution with the primary goal of allowing inclusion in GNU/Linux distributions. Description Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers...

GLSA-202409-26 : IcedTea: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202409-26 IcedTea: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in IcedTea. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

AZL-50147 CVE-2024-46843 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcdasyncscan fails during ufshcdprobehba before adding a SCSI host with scsiaddhost and M...

UBUNTU-CVE-2024-46812

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration Why Coverity reports Memory - illegal accesses. How Skip inactive planes...

ALPINE-CVE-2024-47175

CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5, can...

CVE-2024-47175

CUPS is a standards-based, open-source printing system, and libppd can be used for legacy PPD file support. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5, can...

goTenna Pro X and Pro X2 (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Low attack complexity Vendor : goTenna Equipment : Pro series Vulnerabilities : Weak Password Requirements, Insecure Storage of Sensitive Information, Missing Support for Integrity Check, Cleartext Transmission of Sensitive Information,...

Release Information for Veeam Backup for Nutanix AHV Plug-In Hotfix (12.6.0.636)

Requirements To upgrade to Veeam Backup for Nutanix AHV 6.1, download the installer below and run it on the Veeam Backup & Replication server that manages the AHV Backup Appliances. The Veeam Backup for Nutanix AHV 6.1 Plug-In must be installed before updating the Nutanix AHV Backup Appliance. Yo...

GHSA-RGG8-G5X8-WR9V Cross-site scripting (XSS) in the clipboard package

Impact During a recent internal audit, we identified a Cross-Site Scripting XSS vulnerability in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious...

WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Fluent Support versions = 1.8.0...

WordPress Fluent Support plugin <= 1.8.0 - Broken Access Control on Email Verification vulnerability

Broken Access Control on Email Verification vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Fluent Support versions = 1.8.0...

PT-2024-31709 · Unknown · Ckeditor 5

Name of the Vulnerable Software and Affected Versions: CKEditor 5 versions 40.0.0 through 43.1.1 Description: A Cross-Site Scripting XSS issue is present in the CKEditor 5 clipboard package, which could be triggered by a specific user action, leading to unauthorized JavaScript code execution if a...

Oracle Linux 8 : kernel (ELSA-2024-7000)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-7000 advisory. - wifi: mac80211: Avoid address calculations via out of bounds array indexing Michal Schmidt RHEL-51278 CVE-2024-41071 - protect the fetch of -fdfd in...

WordPress Fluent Support Plugin <= 1.8.0 is vulnerable to Broken Access Control

Software Fluent Support Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1b6430288129 Credits Khalid Yusuf Required privileg...

Browser content redirection is supported for Citrix Workspace app 2402 LTSR now

Browser content redirection is supported for Citrix Workspace appCWA 2402 LTSR...

WordPress Fluent Support Plugin <= 1.8.0 is vulnerable to SQL Injection

Software Fluent Support Type Plugin Vulnerable versions = 1.8.0 Fixed in 1.8.1 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-47304 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 80896110802b Credits Khalid Yusuf Required privilege Subscriber...

XenServer and Citrix Hypervisor Security Update for CVE-2024-45817

XenServer and Citrix Hypervisor Security Update Description of Problem An issue has been identified that affects both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR and allow a malicious administrator of a guest VM to cause the host to crash or become unresponsive. This issue has the following...

kernel: phylib: fix potential use-after-free

In the Linux kernel, the following vulnerability has been resolved: phylib: fix potential use-after-free Commit bafbdd527d56 "phylib: Add device reset GPIO support" added call to phydeviceresetphydev after the putdevice call in phydetach. The comment before the putdevice call says that the phydev...