SUSE CVE-2024-53859

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

PT-2024-35457 · Vue-I18N · Vue-I18N

Name of the Vulnerable Software and Affected Versions: vue-i18n versions prior to 9.14.2 vue-i18n versions prior to 10.0.5 Description: The issue concerns a Cross-site Scripting XSS attack possibility in vue-i18n, an internationalization plugin for Vue.js. This occurs when locale message ASTs are...

PT-2024-32406 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p22 Checkmk versions prior to 2.2.0p37 Checkmk versions prior to 2.1.0p50 EOL Description: The issue concerns the insertion of sensitive information into log files in Checkmk, causing remote site secrets to be...

DEBIAN-CVE-2024-53859

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

DEBIAN-CVE-2024-53849

editorconfig-core-c is theEditorConfig core library written in C for use by plugins supporting EditorConfig parsing. In affected versions several overflows may occur in switch case '' when the input pattern contains many escaped characters. The added backslashes leave too little space in the outp...

Atlassian Confluence 7.19.x < 7.19.26 / 7.20.x < 8.5.12 / 8.6.x < 8.9.4 / 9.0.x < 9.0.1 (CONFSERVER-98481)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-98481 advisory. - An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted...

Improper Preservation of Permissions

Overview lakefs-sdk is a lakeFS API Affected versions of this package are vulnerable to Improper Preservation of Permissions via the process of re-creating a user with the same username as a previously deleted one. An attacker can gain access to the system using the credentials of the deleted use...

CVE-2024-53267 Vulnerability with bundle verification in sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

CVE-2024-32965 ssrf vulnerability in lobe-chat

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header...

GitLab 12.6 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-8237)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Inefficient Algorithmic Complexity in GitLab CVE-2024-8237 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

GitLab 16.9.8 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-11669)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Incorrect Authorization in GitLab CVE-2024-11669 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

GitLab 8.12 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-8114)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Missing Authorization in GitLab CVE-2024-8114 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenabl...

Atlassian SourceTree 4.2.8 RCE

The version of Atlassian SourceTree installed on the remote MacOS host is version 4.2.8. It is, therefore, affected by a remote code execution vulnerability. An attacker, with the interaction of an authorized user, can execute arbitrary code on the affected host. Note that Nessus has not tested f...

Rockwell Automation FactoryTalk Updater Client 4.20.00 RCE

The version of Rockwell Automation FactoryTalk Updater Client installed on the remote Windows host is prior to 4.20.0. It is, therefore, affected by a remote code execution vulnerability. For more information, consult the vendor advisory. Note that Nessus has not tested for these issues but has...

Atlassian SourceTree 3.4.19 RCE

The version of Atlassian SourceTree installed on the remote Windows host is version 3.4.19. It is, therefore, affected by a remote code execution vulnerability. An attacker, with the interaction of an authorized user, can execute arbitrary code on the affected host. Note that Nessus has not teste...

Adobe InDesign < 19.5.1 / 20.0.0 < 20.0.1 Memory leak (APSB24-91) (macOS)

The version of Adobe InDesign installed on the remote macOS host is prior to 19.5.1, 20.0.1. It is, therefore, affected by a vulnerability as referenced in the APSB24-91 advisory. - Out-of-bounds Read CWE-125 potentially leading to Memory leak CVE-2024-49529 Note that Nessus has not tested for th...

Timing Attack

Overview authentik-client is an authentik Affected versions of this package are vulnerable to Timing Attack due to the usage of a non-constant time comparison for the /-/metrics/ endpoint. An attacker can brute-force the SECRETKEY, which is used to authenticate the endpoint, by observing the time...

LightGBM < 4.6.0 RCE

The version of the LightGBM library installed on the remote host is prior to 4.6.0. It is, therefore, affected by a remote code execution vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 8090...

JetBrains WebStorm < 2024.3 Code Execution

The version of JetBrains WebStorm installed on the remote host is prior to 2024.3 . It is, therefore, affected by a code execution vulnerability as referenced in the vendor advisory. Code Execution can occur in Untrusted Project mode via specifically constructed type definitions in the installer...

Information Exposure

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Information Exposure via dynamic tables. Remediation Upgrade moodle/moodle to version 4.1.13, 4.2.10, 4.3.7, 4.4.3 or higher. References - Git Commit - GitHub Commit - Moodle Forum - Red Hat Bugzill...