Malicious code in alias-to_method (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6564 Malicious code in alias-to_method (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in alias-scope (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6563 Malicious code in alias-scope (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in alias-helper (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in alias-metrics (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6561 Malicious code in alias-helper (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6562 Malicious code in alias-metrics (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in alias-class (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6560 Malicious code in alias-class (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in active-support_alias_class_method (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-6303 Missing Authorization in Conduit

Missing authorization in Client-Server API in Conduit =0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the...

PT-2024-37525 · Conduit · Conduit

Name of the Vulnerable Software and Affected Versions: Conduit versions prior to 0.7.0 Description: The issue concerns missing authorization in the Client-Server API, allowing for unauthorized removal and addition of aliases to different rooms. This can be exploited for privilege escalation by...

SUSE CVE-2023-6710

A flaw was found in the modproxycluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting XSS vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host an...

CVE-2024-35221 Denial of service when publishing a package on rubygems.org

Rubygems.org is the Ruby community's gem hosting service. A Gem publisher can cause a Remote DoS when publishing a Gem. This is due to how Ruby reads the Manifest of Gem files when using Gem::Specification.fromyaml. fromyaml makes use of SafeYAML.load which allows YAML aliases inside the YAML-bas...

SUSE CVE-2023-52774

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: protect device queue against concurrent access In dasdprofilestart the amount of requests on the device queue are counted. The access to the device queue is unprotected against concurrent access. With a lot of parallel...

Oracle Linux 8 : tigervnc (ELSA-2024-3261)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3261 advisory. - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents Resolves: RHEL-30755 - Fix CVE-2024-31083...

tigervnc security update

1.13.1-10 - Drop patches that are already part of xorg-x11-server Resolves: RHEL-30755 Resolves: RHEL-30767 Resolves: RHEL-30761 1.13.1-9 - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents Resolves: RHEL-30755 - Fix CVE-2024-31083 tigervnc...

OESA-2024-1652 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix Oops in dasdaliasgetstartdev due to missing pavgroup Fix Oops in dasdaliasgetstartdev function caused by the pavgroup pointer being NULL. The...

DEBIAN-CVE-2023-52774

In the Linux kernel, the following vulnerability has been resolved: s390/dasd: protect device queue against concurrent access In dasdprofilestart the amount of requests on the device queue are counted. The access to the device queue is unprotected against concurrent access. With a lot of parallel...