Fedora 41 : microcode_ctl (2024-8b65ec8c46)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-8b65ec8c46 advisory. - Update to upstream 2.1-46. 20241029 - Update of 06-b7-01/0x32 RPL-S B0 microcode from revision 0x129 up to 0x12b. Tenable has extracted the preceding...

Fedora 38 : grafana (2022-8e5d214237)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8e5d214237 advisory. Automatic update for grafana-9.0.9-1.fc38. Changelog Wed Sep 21 2022 Andreas Gerstmayr 9.0.9-1 - update to 9.0.9 tagged upstream community sources, see...

Fedora 37 : rubygem-pdfkit (2022-c0d55cd527)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-c0d55cd527 advisory. New version 0.8.7.2 is released. ---- New version 0.8.7.1 is released. ---- Update to 0.8.7. This new release fixes CVE-2022-25765. Tenable has extracted the...

Fedora 37 : thunderbird (2022-d98633f466)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-d98633f466 advisory. Update to 102.3.1 https://www.mozilla.org/en-US/security/advisories/mfsa2022-43/ https://www.thunderbird.net/en-US/thunderbird/102.3.1/releasenotes/ Tenable...

Fedora 37 : chromium (2022-3f28aa88cf)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-3f28aa88cf advisory. Update to chromium-105.0.5195.125. This package only has minor changes... ah, just kidding. Here is the pile of security issues it fixes:...

Fedora 41 : rust-pyo3 / rust-pyo3-build-config / rust-pyo3-ffi / etc (2024-21666fa7f2)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-21666fa7f2 advisory. Update pyo3 to version 0.22.4. This version addresses a potential use-after-free RUSTSEC-2024-0378. Tenable has extracted the preceding description block...

Fedora 41 : etcd (2024-cc8fcab025)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-cc8fcab025 advisory. Automatic update for etcd-3.5.13-1.fc41. Changelog Tue Apr 16 2024 Mikel Olasagasti Uranga - 3.5.13-1 - Update to 3.5.13 - Closes rhbz2225797...

PT-2024-8489 · Mozilla · Pdf.Js

Name of the Vulnerable Software and Affected Versions: macro-pdfviewer versions prior to 2.5.6 Description: The macro-pdfviewer, a PDF Viewer Macro for XWiki using Mozilla pdf.js, has a vulnerability that allows an attacker to view any attachment using the "Delegate my view right" feature. This c...

PT-2024-16390 · WordPress · Wpforms

Name of the Vulnerable Software and Affected Versions: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress versions up to, and including, 1.9.1.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect...

SUSE-SU-2024:3976-1 Security update for pcp

This update for pcp fixes the following issues: pcp was updated from version 3.11.9 to version 6.2.0 jscPED-8192, jscPED-8389: - Security issues fixed: CVE-2024-45770: Fixed a symlink attack that allows escalating from the pcp to the root user bsc1230552 CVE-2024-45769: Fixed a heap corruption...

PT-2024-8450

Name of the Vulnerable Software and Affected Versions Laravel versions 6.20.45 through 11.31.0 Description The issue is related to the register argc argv php directive being set to on, allowing users to change the environment used by the framework when handling requests with a special crafted que...

PT-2024-32648 · Netty +1 · Netty +1

Name of the Vulnerable Software and Affected Versions: Netty versions prior to 4.1.115 Description: The issue is related to an unsafe reading of environment files, potentially causing a denial of service in Netty. When loaded on a Windows application, Netty attempts to load a file that does not...

PT-2024-39876 · WordPress · Rss Feed Widget

Name of the Vulnerable Software and Affected Versions: RSS Feed Widget WordPress plugin versions prior to 3.0.0 Description: The issue concerns the RSS Feed Widget WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher...

PT-2024-39875 · WordPress · Rss Feed Widget

Name of the Vulnerable Software and Affected Versions: RSS Feed Widget WordPress plugin versions prior to 3.0.1 Description: The issue arises from the failure to escape the REQUEST URI parameter before outputting it back in an attribute. This could lead to Reflected Cross-Site Scripting in old we...

PT-2024-9111 · Gnome +9 · Gnome Glib +9

Name of the Vulnerable Software and Affected Versions: GNOME GLib versions prior to 2.82.1 Description: The issue is related to an off-by-one error and resultant buffer overflow in the gio/gsocks4aproxy.c component of GNOME GLib. This occurs because SOCKS4 CONN MSG LEN is not sufficient for a...

openSUSE 15 Security Update : qbittorrent (openSUSE-SU-2024:0358-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0358-1 advisory. - Update to version 5.0.1 fixes boo1232731 CVE-2024-51774 Added features: Add 'Simple pread/pwrite' disk IO type Bug fixes: Don't ignore SSL errors...

CVE-2024-47719 affecting package kernel for versions less than 6.6.56.1-5

CVE-2024-47719 affecting package kernel for versions less than 6.6.56.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-51989

The CVE-2024-51989 entry describes a cross-site scripting (XSS) vulnerability in PasswordPusher, affecting versions v1.41.1 through v1.48.0. The root cause is an unsanitized parameter that enables injection of malicious JavaScript. Affected deployments include self-hosted PasswordPusher installat...

Security update for go1.23-openssl

This update for go1.23-openssl fixes the following issues: This update ships go1.23-openssl version 1.23.2.2. jscSLE-18320 go1.23.2 released 2024-10-01 includes fixes to the compiler, cgo, the runtime, and the maps, os, os/exec, time, and unique packages. go69119 os: double close pidfd if caller...

RHEL 8 : java-1.8.0-ibm (RHSA-2024:6595)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6595 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to...