CVE-2024-27852

A privacy issue was addressed with improved client ID handling for alternative app marketplaces. This issue is fixed in iOS 17.5 and iPadOS 17.5. A maliciously crafted webpage may be able to distribute a script that tracks users on other webpages...

CVE-2024-27852

A privacy issue was addressed with improved client ID handling for alternative app marketplaces. This issue is fixed in iOS 17.5 and iPadOS 17.5. A maliciously crafted webpage may be able to distribute a script that tracks users on other webpages...

PT-2024-25823 · Apache · Apache Karaf Cave

Name of the Vulnerable Software and Affected Versions: Apache Karaf Cave versions all Description: The issue is related to an Improper Input Validation vulnerability. This vulnerability only affects products that are no longer supported by the maintainer. Users are recommended to find an...

GHSA-WGRM-67XF-HHPQ PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true which is the default value, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval:...

avahi: Reachable assertion in avahi_alternative_host_name

A vulnerability was found in Avahi. A reachable assertion exists in the avahialternativehostname function...

WordPress RSS Redirect & Feedburner Alternative plugin <= 3.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin RSS Redirect & Feedburner Alternative versions = 3.9...

WordPress RSS Redirect & Feedburner Alternative Plugin <= 3.9 is vulnerable to Broken Access Control

Software RSS Redirect & Feedburner Alternative Type Plugin Vulnerable versions = 3.9 Fixed in 4.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31435 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2dc0e834ad73 Credits Dhabaleshwa...

[SECURITY] Fedora 40 Update: abseil-cpp-20240116.2-1.fc40

Abseil is an open-source collection of C++ library code designed to augment the C++ standard library. The Abseil library code is collected from Google's own C++ code base, has been extensively tested and used in production, and is the same code we depend on in our daily coding lives. In some case...

WordPress wpDiscuz plugin <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Uploaded Image Alternative Text vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin wpDiscuz versions = 7.6.15...

Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...

GHSA-W7HM-HMXV-PVHF HPACK decoder panics on invalid input

Due to insufficient checking of input data, decoding certain data sequences can lead to Decoder::decode panicking rather than returning an error. Example code that triggers this vulnerability looks like this: rust use hpack::Decoder; pub fn main let input = &0x3f; let mut decoder = Decoder::new;...

The vulnerability of server software like HAProxy, related to bypassing authentication using an alternative path or channel, allows attackers to obtain confidential information.

The vulnerability of the server software HAProxy is related to the inclusion of as part of the URI component. Exploiting this vulnerability can allow a remote attacker to obtain confidential information...

[SECURITY] Fedora 40 Update: ghc-isocline-1.0.9-28.fc40

A Haskell wrapper around the Isocline C library alternative to GNU Readline. The Isocline library is included whole and there are no runtime dependencies...

U.S. Sanctions 3 Cryptocurrency Exchanges for Helping Russia Evade Sanctions

The U.S. Department of the Treasury's Office of Foreign Assets Control OFAC sanctioned three cryptocurrency exchanges for offering services used to evade economic restrictions imposed on Russia following its invasion of Ukraine in early 2022. This includes Bitpapa IC FZC LLC, Crypto Explorer DMCC...

EulerOS Virtualization 2.11.0 : avahi (EulerOS-SA-2024-1438)

According to the versions of the avahi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in Avahi, where a reachable assertion exists in avahidnspacketappendrecord. CVE-2023-38469 - A...

RUSTSEC-2024-0320 yaml-rust is unmaintained.

The maintainer seems unreachable. Many issues and pull requests have been submitted over the years without any response. Alternatives Consider switching to the actively maintained yaml-rust2 fork of the original project: - yaml-rust2 - yaml-rust2 @ crates.io...

CVE-2024-26634 net: fix removing a namespace with conflicting altnames

In the Linux kernel, the following vulnerability has been resolved: net: fix removing a namespace with conflicting altnames Mark reports a BUG when a net namespace is removed. kernel BUG at net/core/dev.c:11520! Physical interfaces moved outside of initnet get "refunded" to initnet when that...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to bypassing the authentication process through an alternative path or channel, allows a hacker to perform arbitrary actions.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of JetBrains TeamCity relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to perform arbitrary actions remotely...

[SECURITY] Fedora 40 Update: truth-1.0.1-11.fc40

Truth is a library provides alternative ways to express assertions in unit tests. It can be used as a replacement for JUnit's assertions or FEST or it can be used alongside where other approaches seem more suitable...

Design/Logic Flaw

A CWE-693 “Protection Mechanism Failure” vulnerability in the embedded Chromium browser concerning the handling of alternative URLs, other than “ http://localhost” http://localhost” allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded...