[SECURITY] [DLA 3954-2] postgresql-13 - regression update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3954-2 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 21, 2024 https://wiki.debian.org/LTS -...

PT-2024-34601 · Gibbon · Gibbon

Name of the Vulnerable Software and Affected Versions: Gibbon versions prior to 28.0.00 Description: The issue allows a remote attacker to obtain sensitive information via the email parameter found in the "/Gibbon/modules/User Admin/user manage editProcess.php" API endpoint. Recommendations: For...

PT-2025-2615

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue arises from the Linux kernel's handling of the extent tree during its shrink operation. Specifically, when there is a huge number of extent nodes in the extent tree, the kernel may ho...

Progress Telerik UI for WinForms < 2024.4.1113 Unsafe Deserialization

The version of Progress Telerik UI for WinForms installed on the remote host is prior to 2024.4.1113. It is, therefore, affected by the following vulnerability: - In Progress Telerik UI for WinForms versions prior to 2024 Q4 2024.4.1113, a code execution attack is possible through an insecure...

GHSA-7225-M954-23V7 ASA-2024-010: cosmossdk.io/math: Mismatched bit-length validation in sdk.Int and sdk.Dec can lead to panic

Name: ASA-2024-010: Mismatched bit-length in sdk.Int and sdk.Dec can lead to panic Component: Cosmos SDK / Math Criticality: High Considerable Impact, and Possible Likelihood per ACMv1.2 Affected versions: cosmossdk.io/math package versions !NOTE When on a lower version than cosmossdk.io/math...

PT-2024-72: Weakness of password policy in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.49.0. The application allows users to set weak and easily bruteforced passwords. The discovered vulnerability allows attackers to bruteforce the password and gain access to the application with privileges of the corresponding...

aioHTTP < 3.10.11 Request Smuggling

The version of aioHTTP installed on the remote host is prior to 3.10.11. It is, therefore, affected by a request smuggling vulnerability. aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions...

PT-2024-9380 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.11 Drupal Core versions 10.3.0 through 10.3.9 Drupal Core versions 11.0.0 through 11.0.8 Description: A vulnerability in Drupal Core allows privilege escalation. This issue is related to inconsistencies...

PT-2024-34956 · Figoli Quinn & Associates · Figoli Quinn & Associates Mobile Kiosk

Name of the Vulnerable Software and Affected Versions: Figoli Quinn & Associates Mobile Kiosk versions n/a through 1.3.0 WordPress Mobile Kiosk Plugin version 1.3.0 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site...

SUSE-SU-2024:4019-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter was updated from version 1.0.1 to 1.0.8: - Security issues fixed: CVE-2023-3978: Fixed security bug in x/net dependency in version 1.0.2 bsc1213933 - Bugs fixed: Require Go 1.20 when building for RedHat derivatives...

Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter: Security issues fixed: CVE-2023-3978: Fixed security bug in x/net dependency bsc1213933 Other changes and issues fixed: Delete unpackaged debug files for RHEL Do not include source files in the package for RHEL 9...

SUSE-SU-2024:4011-1 Security update for SUSE Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter: - Security issues fixed: CVE-2023-3978: Fixed security bug in x/net dependency bsc1213933 - Other changes and issues fixed: Delete unpackaged debug files for RHEL Do not include source files in the package for RHEL 9...

PT-2024-8746 · Siemens · Tecnomatix Plant Simulation +1

Name of the Vulnerable Software and Affected Versions: Teamcenter Visualization versions prior to V14.2.0.14 Teamcenter Visualization versions prior to V14.3.0.12 Teamcenter Visualization versions prior to V2312.0008 Teamcenter Visualization versions prior to V2406.0005 Tecnomatix Plant Simulatio...

PT-2024-8737 · Siemens · Tecnomatix Plant Simulation +1

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation versions prior to V2302.0018 Tecnomatix Plant Simulation versions prior to V2404.0007 Teamcenter Visualization versions prior to V14.2.0.14 Teamcenter Visualization versions prior to V14.3.0.12 Teamcenter...

PT-2024-16311 · Google · Google For Woocommerce

Name of the Vulnerable Software and Affected Versions: Google for WooCommerce plugin for WordPress versions up to, and including, 2.8.6 Description: The issue is related to an Information Disclosure vulnerability due to a publicly accessible print php information.php file. This allows...

PT-2024-34125 · WordPress · Cm Table Of Contents

Name of the Vulnerable Software and Affected Versions: CM Table Of Contents WordPress plugin versions prior to 1.2.3 Description: The issue concerns a lack of CSRF check when resetting settings, which could allow attackers to make a logged-in admin perform such an action via a CSRF attack...

PT-2024-35492 · Veritas · Veritas Enterprise Vault

Name of the Vulnerable Software and Affected Versions: Veritas Enterprise Vault versions prior to 15.1 UPD882911 Description: The issue allows an authenticated remote attacker to inject a parameter into an HTTP request, enabling Cross-Site Scripting XSS while viewing archived content. This could...

[SECURITY] Fedora 39 Update: php-bartlett-PHP-CompatInfo-7.1.4-3.fc39

PHPCompatInfo will parse a file/folder/array to find out the minimum version and extensions required for it to run. CLI version has many reports extension, interface, class, function, constant to display and ability to show content of dictionary references...

Fedora 41 : python-jinja2 (2024-b595c68c09)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b595c68c09 advisory. Automatic update for python-jinja2-3.1.4-1.fc41. Changelog Tue May 7 2024 Lumr Balhar - 3.1.4-1 - Update to 3.1.4 rhbz2279211,rhbz2279491 Tenable has extract...

Security Update for Microsoft Visual Studio Code Remote SSH Extension (November 2024)

The Microsoft Visual Studio Code Remote SSH Extension is prior to version 0.115.1. It is, therefore, affected by an undisclosed elevation of privilege vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...