Stable Channel Update for Desktop

The Stable channel has been updated to 129.0.6668.89/.90 for Windows, Mac and 129.0.6668.89 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept restrict...

PT-2024-9585

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description GStreamer is a library for constructing graphs of media-handling components. An uninitialized stack variable vulnerability has been identified in the gst matroska demux add wvpk header function...

PT-2024-9613

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds write vulnerability in the gst ssa parse remove override codes function, which is responsible for parsing and removing SSA style override codes. This...

CVE-2024-47180 Shields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badges

Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version server-2024-09-25 are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic...

PT-2024-6441

Name of the Vulnerable Software and Affected Versions CUPS versions 2.x cups-filters versions up to 2.0.1 Description The issue is related to the FoomaticRIPCommandLine function in the CUPS printing system, which allows remote command execution via a PPD file. This can be exploited when combined...

PT-2024-9623 · Gstreamer +10 · Gstreamer +10

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: An out-of-bounds write issue was identified in the convert to s334 1a function in isomp4/qtdemux.c. This issue arises due to a discrepancy between the size of memory allocated to the storage...

PT-2024-11664 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information from the cookie. This could be exploited by a remote attacker...

PT-2024-28923 · Unknown · Btstack Mesh

Name of the Vulnerable Software and Affected Versions: btstack mesh versions before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 Description: The issue allows a remote attacker to execute arbitrary code via the pb adv handle tranaction cont function in the src/mesh/pb adv.c component. This is a...

PT-2025-6048

Name of the Vulnerable Software and Affected Versions npm-serialize-javascript versions up to 6.0.1 Description The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to injec...

CVE-2024-8775

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in sensitive data...

RHSA-2022:0323 Red Hat Security Advisory: nginx:1.20 security update

Bulletin has no description...

RHSA-2016:1929 Red Hat Security Advisory: Red Hat Virtualization Manager (RHV) bug fix 3.6.9

Bulletin has no description...

RHSA-2009:1198 Red Hat Security Advisory: java-1.6.0-ibm security update

Bulletin has no description...

CVE-2024-43793 Halo's editor has a stored XSS vulnerability

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a...

PT-2024-28305 · WordPress · Gallery Plugin

Name of the Vulnerable Software and Affected Versions: The Gallery Plugin for WordPress versions prior to 1.8.15 Description: The issue is related to the lack of sanitization and escaping of some image settings in the plugin, which could allow users with post-writing privileges, such as Authors, ...

PT-2024-7963 · Eclipse +1 · Eclipse Glassfish +1

Name of the Vulnerable Software and Affected Versions: Eclipse Glassfish versions prior to 7.0.10 Description: A URL redirection issue to untrusted sites exists, caused by a vulnerability in the included Apache code. This issue only affects applications explicitly deployed to the root context '/'...

[SECURITY] [DLA 3885-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3885-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 10, 2024 https://wiki.debian.org/LTS -...

PT-2024-6310 · Gitlab +2 · Gitlab +2

Name of the Vulnerable Software and Affected Versions: Ruby-SAML versions prior to 1.17.0 Ruby-SAML versions 1.13.0 through 1.16.0 GitLab versions prior to 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10 Description: The vulnerability is related to the Ruby SAML library, which is used for implementi...

PT-2024-9671 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-10 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows remote authenticated users with...

PT-2024-38935 · WordPress · Wp Adcenter

Name of the Vulnerable Software and Affected Versions: WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the ad alignment attribute due to insufficient input sanitization and output...