SUSE-SU-2023:4294-1 Security update for webkit2gtk3

This update for webkit2gtk3 ships missing Lang packages to SUSE Linux Enterprise 15 SP4 and SP5. Security fixes: - CVE-2023-41993: Fixed an issue where processing malicious web content could have lead to arbitrary code execution bsc1215661. - CVE-2023-39928: Fixed a use-after-free that could be...

SUSE: Security Advisory (SUSE-SU-2023:4211-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4211-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - CVE-2023-41993: Fixed an issue where processing malicious web content could have lead to arbitrary code execution bsc1215661. - CVE-2023-39928: Fixed a use-after-free that could be exploited to execute arbitrary code when visiting a...

SUSE-SU-2023:4209-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - CVE-2023-41993: Fixed an issue where processing malicious web content could have lead to arbitrary code execution bsc1215661. - CVE-2023-39928: Fixed a use-after-free that could be exploited to execute arbitrary code when visiting a...

Fedora: Security Advisory for composer (FEDORA-2023-f3dedfef46)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

org.webjars.bower:boosted (>=3.2.0, <=3.3.3), org.webjars.bower:jpkleemans-angular-validate (1.1.1) +14 more potentially affected by CVE-2025-3573 via org.webjars.bower:jquery-validation (>=1.13.1, <=1.19.5)

org.webjars.bower:jquery-validation MAVEN version =1.13.1, =3.2.0, =0.1.13, =1.8.0, =2.6.0, =2.7.1, =2.9.1, =3.27.0, =3.28.2, =3.31.0 and more Source cves: CVE-2025-3573 Source advisory: SNYK:JAVA-ORGWEBJARSBOWER-9788112...

11-builder (0.1.0), 2muchcoffee-react-scripts (0.1.0) +3095 more potentially affected by CVE-2023-45311 via fsevents (>=1.0.14, <=1.2.9)

fsevents NPM version =1.0.14, =0.1.0, =1.0.3, =0.1.4, =1.0.0-beta.1, =0.0.1, =0.7.1, =1.1.0-1, =1.0.0, =1.1.2, =1.1.9 - @abelmuro/food-dasher-app 1.0.0 - @accumineapps/hourlyactual 0.1.0 and more Source cves: CVE-2023-45311 Source advisory: OSV:GHSA-8R6J-V8PM-FQW3...

Apache Kafka Connect API Vulnerability in Bitbucket Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 7.21.0, 8.7.1, 8.8.0, 8.9.0, 8.10.0, 8.11.0, and 8.12.0 of Bitbucket Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 8.8 and a CVSS Vector of...

GHSA-MVRP-3CVX-C325 Zod denial of service vulnerability during email validation

Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...

Zod denial of service vulnerability during email validation

Impact API servers running express-zod-api having: - version of express-zod-api below 10.0.0-beta1, - and using the following or similar validation schema in its implementation: z.string.email, are vulnerable to a DoS attack due to: - Inefficient Regular Expression Complexity in zod versions up t...

composer injection vulnerability

composer is a software application . Provides a declaration to manage and install dependencies for PHP projects. Composer suffers from an injection vulnerability that stems from vulnerability to remote code execution vulnerabilities...

jackson-databind: denial of service via cylic dependencies

jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that this is not a valid vulnerability report, because the steps of constructing a cyclic data structure...

Mitigating Risk with Custom First-Party Software and Application Components: A CISOs’ Guide

What is First-Party Software Anyway? First-party software, unlike off-the-shelf ‘Third-Party’ software, is custom open-source software OSS and applications created by organizations to stitch together existing software to meet custom business needs. Nearly every company today uses some form of...

SUSE-FU-2023:3696-1 Feature update for LibreOffice

This update for LibreOffice fixes the following issues: libreoffice: - Version update from 7.3.6.2 to 7.5.4.1 jscPED-3561, jscPED-3550, jscPED-1785: For the highlights of changes of version 7.5 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.5 For the...

SUSE-SU-2023:2783-2 Security update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack, python-opencensus, python-opencensus-context, python-opencensus-ext-threading, python-opentelemetry-api, python-psutil, python-pytest-asyncio, python-requests, python-websocket-client, python-websockets

This update for grpc, protobuf, python-Deprecated, python-PyGithub, python-aiocontextvars, python-avro, python-bcrypt, python-cryptography, python-cryptography-vectors, python-google-api-core, python-googleapis-common-protos, python-grpcio-gcp, python-humanfriendly, python-jsondiff, python-knack,...

Exploit for OS Command Injection in Wago Compact_Controller_100_Firmware

CVE-2023-1698 WAGO Remote Exploit Tool Description This sc...

The vulnerability of the resolve_dependencies function in the libsolv library, which allows a malicious actor to trigger a service failure.

The vulnerability of the resolvedependencies function in the libsolv library is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Oracle Linux 8 : pki-core:10.6 / and / pki-deps:10.6 (ELSA-2020-4847)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4847 advisory. - In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. CVE-2018-14040 - In Bootstrap before 4.1.2, XSS is possible in the...

Oracle Linux 8 : pki-core:10.6 / and / pki-deps:10.6 (ELSA-2020-1644)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1644 advisory. - A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a...

PHPFusion Path Traversal Vulnerability

PHPFusion is a Malaysian PHPFusion company based on MySql and PHP open source lightweight content management system . The system contains modules for news, articles and forums. A security vulnerability exists in PHPFusion, which stems from the presence of outdated dependencies that allow an...