ALSA-2024:2986 Moderate: python3.11-urllib3 security update

The python-urllib3 package provides the Python HTTP module with connection pooling and file POST abilities. Security Fixes: python-urllib3: Cookie request header isn't stripped during cross-origin redirects CVE-2023-43804 For more details about the security issues, including the impact, a CVSS...

CVE-2024-35220

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not...

CVE-2024-35220 @fastify/session reuses destroyed session cookie

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not...

CVE-2024-35220

Summary: CVE-2024-35220 affects the @fastify/session plugin for Fastify. When restoring a cookie from the session store, the expires field is overridden if maxAge is set, causing expired cookies/sessions to not be destroyed. The issue is fixed in version 10.8.0; affected users should upgrade to 1...

CVE-2024-35220 @fastify/session reuses destroyed session cookie

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not...

CVE-2024-35220 @fastify/session reuses destroyed session cookie

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not...

GHSA-9PHW-7H96-Q3RV scheb/two-factor-bundle bypass two-factor authentication with remember-me option

In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication 2FA using the rememberme cookie. When the rememberme checkbox was used during login, a "REMEMBERME" cookie was created. Upon...

scheb/two-factor-bundle bypass two-factor authentication with remember-me option

In versions prior to 3.26.0 and prior to 4.11.0 of the "scheb/two-factor-bundle" project, a security vulnerability allowed attackers to bypass two-factor authentication 2FA using the rememberme cookie. When the rememberme checkbox was used during login, a "REMEMBERME" cookie was created. Upon...

GHSA-PJ27-2XVP-4QXG @fastify/session reuses destroyed session cookie

Impact When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. Patches Updating to v10.9.0 will solve this. Workarounds None References...

@fastify/session reuses destroyed session cookie

Impact When restoring the cookie from the session store, the expires field is overriden if the maxAge field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. Patches Updating to v10.9.0 will solve this. Workarounds None References...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Markdown Editor Preview Pane. An attacker can inject malicious content into a website or application by exploiting this vulnerability. Details Cross-site scripting or XSS is a code vulnerability that occu...

SUSE CVE-2024-36002

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllpinonpinregister for multiple parent pins In scenario where pin is registered with multiple parent pins via dpllpinonpinregister.., all belonging to the same dpll device. A second call to dpllpinonpinunregister...

fastify session 安全漏洞

fastify session is an open source plugin for fastify. A security vulnerability exists in fastify session version 10.8.0 and earlier that stems from the reuse of a corrupted session cookie...

PT-2024-40226 · Unknown · Scheb/Two-Factor-Bundle

Name of the Vulnerable Software and Affected Versions: scheb/two-factor-bundle versions prior to 3.26.0 scheb/two-factor-bundle versions prior to 4.11.0 Description: A security issue allowed attackers to bypass two-factor authentication 2FA using the remember me cookie. When the remember me...

DEBIAN-CVE-2024-36002

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllpinonpinregister for multiple parent pins In scenario where pin is registered with multiple parent pins via dpllpinonpinregister.., all belonging to the same dpll device. A second call to dpllpinonpinunregister...

UBUNTU-CVE-2024-36002

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllpinonpinregister for multiple parent pins In scenario where pin is registered with multiple parent pins via dpllpinonpinregister.., all belonging to the same dpll device. A second call to dpllpinonpinunregister...

CVE-2024-36002 dpll: fix dpll_pin_on_pin_register() for multiple parent pins

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllpinonpinregister for multiple parent pins In scenario where pin is registered with multiple parent pins via dpllpinonpinregister.., all belonging to the same dpll device. A second call to dpllpinonpinunregister...

Deserialization Of Untrusted Data

illuminate/cookie is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insecure cookie encryption and serialization logic, which allows attackers to potentially decrypt or manipulate cookie data, resulting in arbitrary code execution...

Cookie Leakage

amphp/artax is vulnerable to Cookie Leakage. The vulnerability is due to cookies being leaked to unauthorized domains, which allows an attacker to manipulate cookies in such a way where cookies of foo.bar.example.com were leaked to foo.bar...

CVE-2024-35860

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpflink dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and...