GHSA-WQC8-X2PR-7JQH RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape

Impact RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. An attacker with access to a RestrictedPython environment can write code that gets the...

CVE-2023-30960 Insecure Direct Object Reference (IDOR) in Foundry job-tracker

A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further...

CVE-2023-30960 Insecure Direct Object Reference (IDOR) in Foundry job-tracker

A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further...

CVE-2023-30960

CVE-2023-30960 affects Palantir Foundry’s job-tracker and is an insecure direct object reference (IDOR) vulnerability. The issue allowed querying metadata for builds on resources that users should not access. Root cause details in connected sources indicate a security defect within Foundry job-tr...

[SECURITY] [DLA 3489-1] mediawiki security update

Debian LTS Advisory DLA-3489-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany July 10, 2023 https://wiki.debian.org/LTS Package : mediawiki Version : 1:1.31.16-1+deb10u5 CVE ID : CVE-2022-47927 A security issue was discovered in MediaWiki, a website engine for...

Palantir Foundry job-tracker security vulnerability

Palantir Foundry is a business process management platform from US-based Palantir. A security vulnerability exists in Palantir Foundry job-tracker. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...

CVE-2023-30960: Authorization Bypass Through User-Controlled Key

A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. This defect was resolved with the release of job-tracker 4.645.0. The service was rolled out to all affected Foundry instances. No further...

PT-2023-23089

Name of the Vulnerable Software and Affected Versions Foundry job-tracker versions prior to 4.645.0 Description A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resources they did not have access to. Recommendations For versions pri...

[SECURITY] [DLA 3487-1] fusiondirectory security update and rebuild for php-cas

Debian LTS Advisory DLA-3487-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA Tobias Frost July 08, 2023 https://wiki.debian.org/LTS Package : fusiondirectory Version : 1.2.3-4+deb10u2 CVE ID : CVE-2022-36179 CVE-2022-36180 Debian Bug : A potential Cross Site Scripti...

[SECURITY] [DLA 3484-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3484-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 08, 2023 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 5450-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5450-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 07, 2023 https://www.debian.org/security/faq -...

GHSA-4HPJ-8RHV-9X87 Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module

Impact The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All...

[SECURITY] [DLA 3479-1] golang-yaml.v2 security update

Debian LTS Advisory DLA-3479-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez July 05, 2023 https://wiki.debian.org/LTS Package : golang-yaml.v2 Version : 2.2.2-1+deb10u1 CVE ID : CVE-2021-4235 CVE-2022-3064 Two denial of service vulnerabilities have been...

[SECURITY] [DSA 5447-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5447-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2023 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5443-1 gst-plugins-base1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5443-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 02, 2023 https://www.debian.org/security/faq -...

CVE-2023-21184

In getCurrentPrivilegedPackagesForAllUsers of CarrierPrivilegesTracker.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from Google, an American company. Google Pixel suffers from a security vulnerability that originates in getCurrentPrivilegedPackagesForAllUserss in CarrierPrivilegesTracker.java, where a privilege bypass is possible due to a logic error in the code, which could lead t...

Debian: Security Advisory (DSA-5436-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3464-1] xmltooling security update

Debian LTS Advisory DLA-3464-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón June 21, 2023 https://wiki.debian.org/LTS Package : xmltooling Version : 3.0.4-1+deb10u2 Debian Bug : 1037948 CVE ID : not yet available Jurien de Jong discovered that the parsing...

[SECURITY] [DSA 5434-1] minidlna security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5434-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 21, 2023 https://www.debian.org/security/faq -...