GHSA-3Q97-VJPP-C8RP Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback

Description When linking a social account to an already authenticated user, the lack of a confirmation step introduces a security risk. This is exacerbated if -stateless is used in the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure th...

SUSE CVE-2024-53144

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Align BR/EDR JUSTWORKS paring with LE This aligned BR/EDR JUSTWORKS method with LE which since 92516cd97fd4 "Bluetooth: Always request for user confirmation for Just Works" always request user confirmation wi...

DEBIAN-CVE-2024-53144

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Align BR/EDR JUSTWORKS paring with LE This aligned BR/EDR JUSTWORKS method with LE which since 92516cd97fd4 "Bluetooth: Always request for user confirmation for Just Works" always request user confirmation wi...

CVE-2024-53144

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Align BR/EDR JUSTWORKS paring with LE This aligned BR/EDR JUSTWORKS method with LE which since 92516cd97fd4 "Bluetooth: Always request for user confirmation for Just Works" always request user confirmation wi...

CVE-2024-53144

The CVE-2024-53144 entry maps to a Linux kernel Bluetooth issue in hci_event: BR/EDR JUST_WORKS was aligned with LE, affecting the Just Works pairing flow and forcing user confirmation via confirm_hint due to policy changes in bluetoothd. The description notes this alignment and its rationale; no...

CVE-2024-53144 Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Align BR/EDR JUSTWORKS paring with LE This aligned BR/EDR JUSTWORKS method with LE which since 92516cd97fd4 "Bluetooth: Always request for user confirmation for Just Works" always request user confirmation wi...

CVE-2024-53144 Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Align BR/EDR JUSTWORKS paring with LE This aligned BR/EDR JUSTWORKS method with LE which since 92516cd97fd4 "Bluetooth: Always request for user confirmation for Just Works" always request user confirmation wi...

SUSE CVE-2024-11700

Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox 133 and Thunderbird 133...

Astra Linux – Vulnerability in Firefox

Firefox typically asks for confirmation before requesting the operating system to find an application to handle schemes that the browser does not support. It did not ask for confirmation before handling Usenet-related schemes such as news: and snews:. Since most operating systems do not have a...

gnome-shell: code execution in portal helper

A vulnerability was found in GNOME Shell. A portal helper can be launched automatically without user confirmation based on the network responses provided by an adversary...

gnome-shell: code execution in portal helper

A vulnerability was found in GNOME Shell. A portal helper can be launched automatically without user confirmation based on the network responses provided by an adversary...

PT-2024-33413 · Infomaniak · Vod Infomaniak

Name of the Vulnerable Software and Affected Versions: VOD Infomaniak versions 1.5.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This problem affects VOD Infomaniak, allowin...

CVE-2024-8383

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader...

gnome-shell: code execution in portal helper

A vulnerability was found in GNOME Shell. A portal helper can be launched automatically without user confirmation based on the network responses provided by an adversary...

SUSE-SU-2024:2618-1 Security update for gnome-shell

This update for gnome-shell fixes the following issues: - CVE-2024-36472: Fixed portal helper automatically launched without user confirmation bsc1225567...

CVE-2024-36676

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms...

CVE-2024-36676

BookStack versions prior to v24.05.1 are vulnerable to an incorrect access control flaw. This vulnerability allows an attacker to confirm the existence of system users and perform a targeted notification email Denial of Service (DoS) through public-facing forms. To remediate this issue, users sho...

CVE-2024-36676

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms...

GLSA-202402-20 : Thunar: Arbitrary Code Execution

The remote host is affected by the vulnerability described in GLSA-202402-20 Thunar: Arbitrary Code Execution - An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program based on the fi...

Mozilla Firefox Input Validation Error Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an input validation error vulnerability that stems from the fact that QR Code Scanner does not display a user-confirmed URL before opening a website, potentially directing...