PT-2024-40156 · Twig · Twig

Name of the Vulnerable Software and Affected Versions: Twig affected versions not specified Description: The issue allows for path traversal when Twig is used with Twig Loader Filesystem for loading templates and the application uses non-trusted template names. This enables an attacker to access...

PT-2024-10556 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: Symfony HttpKernel component versions 2.2.X through 2.5.X Description: This issue affects applications with the ESI feature enabled and a proxy in front of the web application. The FragmentHandler considers requests to render fragments as...

PT-2024-40474 · Symfony · Symfony2

Name of the Vulnerable Software and Affected Versions: Symfony2 versions prior to the introduction of the fix Description: The issue arises when an application relies on the client IP address returned by the Request::getClientIp method for making sensitive decisions, such as IP-based access...

PT-2024-40336 · Symfony2 · Symfony2

Name of the Vulnerable Software and Affected Versions: Symfony2 versions prior to the fixed version Description: A security issue was found in the Request::getClientIp method when the trust proxy mode is enabled. This issue affects applications that use the client IP address for sensitive decisio...

CVE-2024-5274

Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High Mitigation Until updated packages are released for Fedora and EPEL, consider temporarily swapping to an...

USN-6799-1: Werkzeug vulnerability

It was discovered that the debugger in Werkzeug was not restricted to trusted hosts. A remote attacker could possibly use this issue to execute code on the host under certain circumstances...

USN-6799-1 python-werkzeug vulnerability

It was discovered that the debugger in Werkzeug was not restricted to trusted hosts. A remote attacker could possibly use this issue to execute code on the host under certain circumstances...

CVE-2023-37411 IBM Aspera Faspex cross-site scripting

IBM Aspera Faspex 5.0.0 through 5.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 260139...

CVE-2024-28793 IBM Engineering Workflow Management cross-site scripting

IBM Engineering Workflow Management 7.0.2 and 7.0.3 is vulnerable to stored cross-site scripting. Under certain configurations, this vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...

Trusted relationship attacks: trust, but verify

IT outsourcing market continues to demonstrate strong growth globally – such services are becoming increasingly popular. But along with the advantages, such as saved time and resources, delegating non-core tasks creates new challenges in terms of information security. By providing third-party...

IBM Security Guardium Cross-Site Scripting Vulnerability (CNVD-2024-26498)

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A cross-site scripting vulnerability exists in IBM Security...

PT-2024-40468 · Unknown · Simplesamlphp

Name of the Vulnerable Software and Affected Versions: SimpleSAMLphp versions prior to 1.14.4 Description: The issue allows attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the link href and retryURL...

Fedora: Security Advisory for tpm2-tss (FEDORA-2024-3265d70b61)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-47710

IBM Security Guardium 11.4, 11.5, and 12.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 27152...

CVE-2023-47710 IBM Security Guardium cross-site scripting

IBM Security Guardium 11.4, 11.5, and 12.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 27152...

CVE-2023-47710

CVE-2023-47710 affects IBM Security Guardium 11.4, 11.5, and 12.0. The flaw is a cross-site scripting vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript, potentially changing functionality and leading to credentials disclosure within a trusted session. Root cause stems f...

OESA-2024-1638 tpm2-tss security update

tpm2-tss is a software stack supporting Trusted Platform ModuleTPM 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers. Security Fixes: A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number i...

OESA-2024-1637 tpm2-tss security update

tpm2-tss is a software stack supporting Trusted Platform ModuleTPM 2.0 system APIs which provides TPM2.0 specified APIs for applications to access TPM module through kernel TPM drivers. Security Fixes: A flaw was found in the tpm2-tss package, where it was not checked to see if the magic number i...

CVE-2024-32969

vantage6 is an open-source infrastructure for privacy preserving analysis. Collaboration administrators can add extra organizations to their collaboration that can extend their influence. For example, organizations that they include can then create new users for which they know the passwords, and...

SUSE CVE-2021-47229

In the Linux kernel, the following vulnerability has been resolved: PCI: aardvark: Fix kernel panic during PIO transfer Trying to start a new PIO transfer by writing value 0 in PIOSTART register when previous transfer has not yet completed which is indicated by value 1 in PIOSTART causes an...