CVE-2025-24024 Mjolnir v1.9.0 accepts commands from any room

Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature tha...

FreeBSD : keycloak -- Multiple security fixes (5e2bd238-d2bb-11ef-bc0e-1c697a616631)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 5e2bd238-d2bb-11ef-bc0e-1c697a616631 advisory. Keycloak reports: This update includes 2 security fixes: Tenable has extracted the preceding...

CVE-2024-55892 Potential Open Redirect via Parsing Differences in TYPO3

TYPO3 is a free and open source Content Management Framework. Applications that use TYPO3\CMS\Core\Http\Uri to parse externally provided URLs e.g., via a query parameter and validate the host of the parsed URL may be vulnerable to open redirect or SSRF attacks if the URL is used after passing the...

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250108T191942 2025-01-08T19:19:42Z. Refs jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3371 GHSA-2r2v-9pf8-6342 GO-2025-3374 CVE-2025-22130 GHSA-j4jw-m6xr-fv6c Update to...

thunderbird security update

128.6.0-3.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 128.6.0 - Add OpenELA debranding 128.6.0-3 - Update to 128.6.0 build3 128.6.0-1 - Update to 128.6.0 build1...

PT-2025-3804

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 134 Firefox ESR versions prior to 128.6 Thunderbird versions prior to 134 Thunderbird versions prior to 128.6 Description The WebChannel API, used for transporting information across processes, did not properly check...

PT-2025-28646

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.24.5 Go versions prior to 1.23.11 Description: The issue concerns unexpected command execution in untrusted VCS repositories when using the Go toolchain. This can occur when the toolchain is used in directories fetched...

SUSE-SU-2024:4433-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20241218T202206 2024-12-18T20:22:06Z. jscPED-11136 Go CVE Numbering Authority IDs added or updated with aliases: GO-2024-3333 - Update to version 0.0.20241218T163557 2024-12-18T16:35:57Z. jscPED-11136 Go CVE...

CVE-2024-56507 Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce

LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting XSS vulnerability exists in the LinkAce. This issue occurs in the "URL" field of the "Edit Link" module, where user input is not properly sanitized or encoded before bein...

CVE-2024-56510 Marp Core allows XSS by improper neutralization of HTML sanitization

@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting XSS due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patch...

SUSE-SU-2024:4360-1 Security update for docker

This update for docker fixes the following issues: - Update docker-buildx to v0.19.2. See upstream changelog online at . Some notable changelogs from the last update: - Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker whic...

Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

Boundary Community Edition and Boundary Enterprise “Boundary” incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary...

CVE-2024-12292 Insertion of Sensitive Information into Log File in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs...

PT-2024-9582 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 9.4 through 17.4.6 GitLab CE/EE versions 17.5 through 17.5.4 GitLab CE/EE versions 17.6 through 17.6.2 Description: The issue affects GitLab CE/EE and is related to an uncontrolled resource consumption. An attacker could...

CVE-2024-48868 QTS, QuTS hero

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...

Microsoft Edge (Chromium-Based) Multiple Vulnerabilities - Dec24

Microsoft Edge Chromium-Based is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2024-9290 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 12.6 GitLab CE/EE versions 17.4 prior to 17.4.5 GitLab CE/EE versions 17.5 prior to 17.5.3 GitLab CE/EE versions 17.6 prior to 17.6.1 Description: A Denial of Service DoS issue has been discovered in GitLab CE/E...

Fedora 40 : php-bartlett-PHP-CompatInfo (2024-727ecb90c7)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-727ecb90c7 advisory. bartlett/php-compatinfo-db 6.12.0 - 2024-10-29 Added - db:show command is now able to display deprecations on all components - PHP 8.2.25 support - PHP 8.3.1...

Fedora 37 : nodejs (2022-1667f7b60a)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-1667f7b60a advisory. November 2022 Security Updates https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/ ---- Update to 18.10.0...

Fedora 41 : thunderbird (2024-a078d86829)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a078d86829 advisory. Update to 128.3.3 https://www.thunderbird.net/en-US/thunderbird/128.3.3esr/releasenotes/ ---- Update to 128.3.2...