RLSA-2024:9457 Moderate: python3.12-urllib3 security update

urllib3 is a powerful, user-friendly HTTP client for Python. urllib3 brings many critical features that are missing from the Python standard libraries: • Thread safety. • Connection pooling. • Client-side SSL/TLS verification. • File uploads with multipart encoding. • Helpers for retrying request...

RHEL 8 : webkit2gtk3 (RHSA-2024:9636)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9636 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: Use after free in...

CVE-2024-54467

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin...

CVE-2024-54467

A cookie management issue was addressed with improved state management. This issue is fixed in watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18 and iPadOS 18, tvOS 18. A malicious website may exfiltrate data cross-origin...

DEBIAN-CVE-2024-54467

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin...

UBUNTU-CVE-2024-54467

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin...

CVE-2024-54467

CVE-2024-54467 involves a cookie-management issue in WebKitGTK (webkit2gtk) that can allow a malicious website to exfiltrate data cross-origin. The initial description notes fixes across Apple platforms (watchOS 11, macOS Sequoia 15, Safari 18, visionOS 2, iOS 18, iPadOS 18, tvOS 18). Connected d...

CVE-2024-54467

A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. A malicious website may exfiltrate data cross-origin...

Cognita 跨站脚本漏洞

Cognita is a TrueFoundry open source RAG framework for building TrueFoundry production modular open source applications. Cognita suffers from a cross-site scripting vulnerability that stems from an insecure CORS configuration...

Linux Distros Unpatched Vulnerability : CVE-2024-44187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cross-origin issue existed with iframe elements. This was addressed with improved tracking of security origins. This issue is fixed in Safari 18, iOS 18 and...

Linux Distros Unpatched Vulnerability : CVE-2024-0810

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to...

Linux Distros Unpatched Vulnerability : CVE-2024-2630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromiu...

Linux Distros Unpatched Vulnerability : CVE-2018-12402

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of Save...

Linux Distros Unpatched Vulnerability : CVE-2019-17014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If an image had not loaded correctly such as when it is not actually an image, it could be dragged and dropped cross-domain, resulting in a cross-origin...

PYSEC-2025-25

Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allowcredentia...

Linux Distros Unpatched Vulnerability : CVE-2010-2764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 do not properly restrict read...

openSUSE Security Advisory (SUSE-SU-2024:2662-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Astra Linux – Vulnerability in Node.js

Undici is an HTTP/1.1 client, developed from scratch for Node.js. Undici already clears Authorization headers during cross-origin redirects, but does not clear Proxy-Authentication headers. This issue has been fixed in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known...

Astra Linux – Vulnerability in Firefox, Thunderbird

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131...

Astra Linux – Vulnerability in Firefox, Thunderbird

An attacker could, through a specially crafted multipart response, execute arbitrary JavaScript under the resource://pdf.js origin. This would allow them to access PDF content from other origins. This access is limited to “same site” documents due to the Site Isolation feature on desktop clients,...