new packages: gnome-user-docs

An update is available for gnome-user-docs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

new packages: gnome-devel-docs

An update is available for gnome-devel-docs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-9WF6-88X4-6XVJ BuddyPress Docs plugin Improper Privilege Management

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...

BuddyPress Docs plugin Improper Privilege Management

An issue was discovered in includes/component.php in the BuddyPress Docs plugin before 1.9.3 for WordPress. It is possible for authenticated users to edit documents of other users without proper permissions...

com.mozu:mozu-api-jobs (>=1.0.13 <=1.0.23), gradle.plugin.com.atc.gradle.plugins.xd:spring-xd-deploy-plugin (>=0.0.1 <=0.0.8) +25 more potentially affected by CVE-2018-1229 via org.springframework.batch:spring-batch-admin-manager (>=1.3.0.RELEASE <=1.3.1.RELEASE)

org.springframework.batch:spring-batch-admin-manager MAVEN version =1.3.0.RELEASE, =1.0.13, =0.0.1, =1.3.1.RELEASE, =1.6.0.RELEASE, =1.0.0.RELEASE, =1.0.0.RELEASE, =1.1.0.RELEASE, =1.0.0.RELEASE, =1.0.0.RELEASE, =1.0.0.RELEASE, =1.1.0.RELEASE, =1.7.3.RELEASE -...

Strapi 安全漏洞

Strapi is an open source headless content management system CMS. A security vulnerability exists in Strapi that stems from the storage of passwords in a recoverable format in the DOCUMENTATION plug-in component. An attacker could use this vulnerability to access a victim's HTTP request, obtain th...

Metasploit Wrap-Up

Redis Sandbox Escape Our very own Jake Baines wrote a module that performs a sandbox escape on Redis versions between 5.0.0 and 6.1.0 and achieves remote code execution as the redis user. Redis installations can be password protected, so this module supports exploiting the vulnerability with and...

Google takes on Docs notification spammers

Cloud-based document suites have always been a hot target for scammers. When it’s easy to dip in and out for collaboration purposes, or just share things generally, then its likely that bad people will want in on the action. In 2019, Google calendar users were wading through endless spam...

CVE-2022-23375

WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php...

@commercetools-docs/gatsby-theme-docs (>=0.0.0-canary-20220509155217 <=19.1.0), @dcl/docs-site (>=1.0.0-3010867520.commit-1740972 <=1.0.0-20220919140413.commit-6dee65c) potentially affected by CVE-2022-25863 via gatsby-plugin-mdx (=3.13.0)

gatsby-plugin-mdx NPM version =3.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gatsby-plugin-mdx and may be impacted: - @commercetools-docs/gatsby-theme-docs =0.0.0-canary-20220509155217, =1.0.0-3010867520.commit-1740972,...

@commercetools-docs/gatsby-theme-docs (>=0.0.0-canary-2021630763 <=17.0.9), @zedvision/zedvision-site (>=13.0.5 <=13.0.11) potentially affected by CVE-2022-25863 via gatsby-plugin-mdx (>=2.0.0 <=2.14.0)

gatsby-plugin-mdx NPM version =2.0.0, =0.0.0-canary-2021630763, =13.0.5, =13.0.11 Source cves: CVE-2022-25863 Source advisory: SNYK:JS-GATSBYPLUGINMDX-2405699...

Security update for firejail (important)

openSUSE Security Update: Security update for firejail Announcement ID: openSUSE-SU-2022:0037-1 Rating: important References: 1195880 Affected Products: openSUSE Backports SLE-15-SP3 An update that contains security fixes can now be installed. Description: This update for firejail fixes the...

org.apache.nifi.registry:nifi-registry-assembly (>=0.1.0 <=0.5.0), org.apache.nifi.registry:nifi-registry-docs (>=0.4.0 <=0.5.0) potentially affected by CVE-2020-9482 via org.apache.nifi.registry:nifi-registry-web-api (>=0.1.0 <=0.5.0)

org.apache.nifi.registry:nifi-registry-web-api MAVEN version =0.1.0, =0.1.0, =0.4.0, =0.5.0 Source cves: CVE-2020-9482 Source advisory: OSV:GHSA-RCWJ-2HJ2-VMJJ...

Mageia: Security Advisory (MGASA-2017-0117)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2018-0055)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 7 : polkit (ELSA-2022-0274)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-0274 advisory. 0.112-26.0.1 - Increase timeout to avoid defunct processes Orabug: 26930744 0.112-26.1 - pkexec: argv overflow results in local privilege esc. - Resolves:...

Attackers Exploit Flaw in Google Docs’ Comments Feature

Attackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign targeted primarily at Outlook users, researchers have discovered. Researchers from email collaboration and security firm Avanan, a CheckPoint company, first observed “a new, massive wave of...

@bitacode/apispecmd-ts (>=0.0.1 <=0.1.2), @layer0/node-license-report (>=0.0.0 <=0.0.3) +13 more potentially affected by CVE-2021-23639 via md-to-pdf (>=2.8.2 <=4.1.0)

md-to-pdf NPM version =2.8.2, =0.0.1, =0.0.0, =0.0.2, =0.0.2, =0.7.2, =1.0.1, =0.2.0, =0.1.0, =1.1.0, =0.2.0, =1.5.0, =1.10.0, =1.0.0, =0.0.2, =0.0.10 Source cves: CVE-2021-23639 Source advisory: OSV:GHSA-X949-7CM6-FM6P...

Failed transfer with low level call could be overlooked

Handle harleythedog Vulnerability details Impact There are several places where low level call is used within the contract. In particular, in SavingsAccount.sol, the external withdraw function has the to argument, which is eventually used in this code in transfer: bool success, = to.callvalue:...

Kubernetes: Broken Github Link Used in deployment docs of "github.com/kubernetes/kompose"

Report Submission Form Summary: Kubernetes have a github project github.com/kubernetes/kompose In the project there is a doc which have installation steps In the steps, doc is referring to another github account repository to clone it and install. But the github account was not registered on...