PT-2024-35716 · Dell · Dell Vxverify

Name of the Vulnerable Software and Affected Versions: Dell VxVerify versions prior to x.40.405 Description: The issue concerns a Plain-text Password Storage Vulnerability in the shell wrapper of Dell VxVerify. A local high privileged attacker could potentially exploit this vulnerability, leading...

Dell VxVerify 安全漏洞

Dell VxVerify is a pre-upgrade operational status checking tool from Dell USA. A security vulnerability exists in Dell VxVerify versions prior to x.40.405, which stems from the storage of plaintext passwords in the shell wrapper, and could allow a local, high-privileged attacker to disclose...

Moderate: Red Hat Security Advisory: RHOSP 17.1.4 (python-zipp) security update

An update for python-zipp is now available for Red Hat OpenStack Platform RHOSP 17.1 Wallaby. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

kernel: drm/amd/display: Refactor DMCUB enter/exit idle interface

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Refactor DMCUB enter/exit idle interface Why We can hang in place trying to send commands when the DMCUB isn't powered on. How We need to exit out of the idle state prior to sending a command, but the process tha...

Moodle authorization headers preserved between "emulated redirects"

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs...

UBUNTU-CVE-2024-43432

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs...

CVE-2024-43432 Moodle: authorization headers preserved between "emulated redirects"

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs...

CVE-2024-43432 Moodle: authorization headers preserved between "emulated redirects"

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs...

SUSE-RU-2024:3971-1 Recommended update for mojo-parent

This update for mojo-parent fixes the following issues: xalan-j2 was updated from version 2.7.2 to 2.7.3: - Security issues fixed: CVE-2022-34169: Fixed integer truncation issue when processing malicious XSLT stylesheets bsc1201684 - Changes and Bugs fixed: Java 8 is now the minimum requirement...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from the cURL wrapper stripping the HTTPAUTH and USERPWD headers during...

SUSE CVE-2024-49927

In the Linux kernel, the following vulnerability has been resolved: x86/ioapic: Handle allocation failures gracefully Breno observed panics when using failslab under certain conditions during runtime: can not alloc irqpinlist -1,0,20 Kernel panic - not syncing: IO-APIC: failed to add irq-pin. Can...

SUSE CVE-2022-48997

In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpmpmsuspend with locks Currently tpm transactions are executed unconditionally in tpmpmsuspend function, which may lead to races with other tpm accessors in the system. Specifically, the hwrandom tpm driver...

Fedora: Security Advisory (FEDORA-2024-ec78ab2c45)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 7 : buildah (RHSA-2020:1231)

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1231 advisory. - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection through the toUtf8 function in the XmlScanner.php file. An attacker can disclose server files and sensitive information by providing an Excel sheet with a modified XML structure, specifying UTF-7 encodi...

CVE-2022-2439

The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'uploadfile' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using...

ABB Cylon Aspect 3.08.01 Remote Code Execution Vulnerability

ABB Cylon Aspect version 3.08.01 BMS/BAS controller suffers from a remote code execution vulnerability. The vulnerable uploadFile function in bigUpload.php improperly reads raw POST data using the php://input wrapper without sufficient validation. This data is passed to the fwrite function,...

PT-2024-30177 · Unknown · Elaine'S Realtime Crm Automation

Name of the Vulnerable Software and Affected Versions: Elaine's Realtime CRM Automation version 6.18.17 Description: A reflected cross-site scripting XSS issue allows attackers to execute arbitrary JavaScript code in a user's web browser by injecting a crafted payload into the dialog parameter at...

MAL-2024-12261 Malicious code in easypydb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6bba8fa7c973e17898962b7fa6aebecdd0d9149b9e3a1f078bbc57f5e4bf7f0a The package is a wrapper around "s1db" package, which offers some kind of easy online database. However, this package silently exfiltrates credentials given by...

Malicious code in easypydb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6bba8fa7c973e17898962b7fa6aebecdd0d9149b9e3a1f078bbc57f5e4bf7f0a The package is a wrapper around "s1db" package, which offers some kind of easy online database. However, this package silently exfiltrates credentials given by...