RequireJS Security Vulnerability

RequireJS is an open source library for RequireJS. It is used to load common JavaScript files as well as more defined modules. A security vulnerability exists in RequireJS version v2.3.6, which originates from the inclusion of prototype contamination via the function s.contexts..configure, allowi...

PT-2024-28314

Name of the Vulnerable Software and Affected Versions requirejs version 2.3.6 Description The issue is related to a prototype pollution vulnerability via the function s.contexts. .configure. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2024-5315 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.2 through 7.5 Description: The issue is related to insufficient authority requirements, allowing a local user without administrator privileges to configure a physical file trigger. This can lead to the execution of the trigge...

How to Configure Veeam Kasten for Kubernetes Dashboard to Use a New Certificate

Purpose This article documents how to troubleshoot and replace the certificate used by the Veeam Kasten for Kubernetes Dashboard. Scenario Example The Veeam Kasten for Kubernetes Dashboard becomes inaccessible due to an expired certificate, resulting in an HTTP ERROR 401 , indicating a lack of...

jenkins-2-plugins: Improper input sanitization in HTML Publisher Plugin

A flaw was found in jenkins-2-plugins. In the HTML Publisher Plugin 1.16 through 1.32, fallback for reports created in HTML Publisher Plugin 1.15 and earlier does not properly sanitize input. This can allow attackers with Item/Configure permissions to implement stored cross-site scripting XSS...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

CVE-2024-28826

Improper restriction of local upload and download paths in checksftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and in Checkmk 2.0.0 EOL allows attackers with sufficient permissions to configure the check to read and write local files on the Checkmk site server...

Jenkins Report Info Plugin Path Traversal vulnerability

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, Report Info Plugin does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permissio...

CVE-2024-5273

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...

SUSE CVE-2021-47288

In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in ngenecommandconfigfreebuf Fix an 11-year old bug in ngenecommandconfigfreebuf while addressing the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16:...

kernel: Bluetooth: L2CAP: Fix u8 overflow

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAPCONFREQ packets, chan-numconfrsp increases multiple times and eventually it will wrap around the maximum number i.e., 255. This patch prevents this by adding a boundary check...

UBUNTU-CVE-2021-47288

In the Linux kernel, the following vulnerability has been resolved: media: ngene: Fix out-of-bounds bug in ngenecommandconfigfreebuf Fix an 11-year old bug in ngenecommandconfigfreebuf while addressing the following warnings caught with -Warray-bounds: arch/alpha/include/asm/string.h:22:16:...

CVE-2024-34419 WordPress Configure Login Timeout plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nathan Vonnahme Configure Login Timeout allows Stored XSS.This issue affects Configure Login Timeout: from n/a through 1.0...

CVE-2024-34419

CVE-2024-34419: Stored XSS in the WordPress plugin Configure Login Timeout (Nathan Vonnahme). The issue is triggered by improper input neutralization during web-page generation, affecting Configure Login Timeout versions up to 1.0 (no details on patch/version beyond 1.0). Attacker requires high p...

WordPress Configure Login Timeout plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Configure Login Timeout versions = 1.0...

WordPress Configure Login Timeout Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Configure Login Timeout Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-34419 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID eea64f2b0ecf Credits Sharanabasappa Required privilege...

UBUNTU-CVE-2023-46047

DISPUTED An issue in Sane 1.2.1 allows a local attacker to execute arbitrary code via a crafted file to the saneiconfigureattach function. NOTE: this is disputed because there is no expectation that the product should be starting with an attacker-controlled configuration file...

libreoffice security update

1:7.1.8.1-12.0.1 - Replace colors with Oracle colors Orabug: 32120093 - Added the --with-hamcrest option to configure. 1:7.1.8.1-12 - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols...

CVE-2024-27192

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Scott Reilly Configure SMTP allows Reflected XSS.This issue affects Configure SMTP: from n/a through 3.1...

CVE-2024-27192

CVE-2024-27192 : The connected sources document a WordPress plugin vulnerability in Configure SMTP (WordPress plugin) that allows Reflected XSS due to improper input neutralization during web page generation. Affected versions are listed as up through 3.1. Exploitation details (vector/conditions)...