RDoc: Remote Code Execution

Background RDoc produces HTML and command-line documentation for Ruby projects. Description A vulnerability has been discovered in RDoc. Please review the CVE identifier referenced below for details. Impact When parsing .rdocoptions used for configuration in RDoc as a YAML file, object injection...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2023-46589)

Summary IBM Security SOAR uses an older version of ElasticSearch that may be identified and exploited. An update has been released which addresses these issues. It is recommended upgrading to Version 51.0.2.1 or later of IBM Security SOAR. Vulnerability Details CVEID:CVE-2024-23450 DESCRIPTION:...

[SECURITY] Fedora 39 Update: composer-2.7.7-1.fc39

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

CVE-2024-36975

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Do not use WARN when encode fails When asn1encodesequence fails, WARN is not the correct solution. 1. asn1encodesequence is not an internal function located in lib/asn1encode.c. 2. Location is known, which makes th...

Exploring malicious Windows drivers (Part 2): the I/O system, IRPs, stack locations, IOCTLs and more

This blog post is part of a multi-part series, and it is highly recommended to read the first entry here before continuing. As the second entry in our "Exploring malicious Windows drivers" series, we will continue where the first left off: Discussing the I/O system and IRPs. We will expand on the...

GHSA-9GHH-MMCQ-8PHC Rancher does not automatically clean up a user deleted or disabled from the configured Authentication Provider

Impact A vulnerability has been identified in which Rancher does not automatically clean up a user which has been deleted from the configured authentication provider AP. This characteristic also applies to disabled or revoked users, Rancher will not reflect these modifications which may leave the...

OPENSUSE-SU-2024:13254-1 python-gevent-doc-23.9.0-1.1 on GA media

These are all security issues fixed in the python-gevent-doc-23.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13210-1 python-bottle-doc-0.12.25-5.1 on GA media

These are all security issues fixed in the python-bottle-doc-0.12.25-5.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13802-1 python-Scrapy-doc-2.11.1-1.1 on GA media

These are all security issues fixed in the python-Scrapy-doc-2.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10193-1 python-doc-2.7.12-1.3 on GA media

These are all security issues fixed in the python-doc-2.7.12-1.3 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11713-1 python-lxml-doc-4.6.5-1.1 on GA media

These are all security issues fixed in the python-lxml-doc-4.6.5-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13890-1 python-gevent-doc-24.2.1-1.1 on GA media

These are all security issues fixed in the python-gevent-doc-24.2.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12273-1 python-lxml-doc-4.9.1-2.1 on GA media

These are all security issues fixed in the python-lxml-doc-4.9.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13486-1 ansible-documentation-2.15.7-1.1 on GA media

These are all security issues fixed in the ansible-documentation-2.15.7-1.1 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 9 : cockpit (ELSA-2024-3843)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3843 advisory. 311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110...

CVE-2024-26229

creationtimestamp| type| source ---|---|--- 2024-06-11 07:33:54+00:00| published-proof-of-concept| https://t.me/truesec/80 2024-06-11 10:21:23+00:00| published-proof-of-concept| https://t.me/RalfHackerChannel/1500 2024-06-11 10:22:25+00:00| published-proof-of-concept| https://t.me/hackingbra/161...

cockpit security update

311.2-1.0.1 - Replaced upstream urls in documentation with oracle links Orabug: 36528753 - Drop subscription-manager-cockpit requirement for ol Orabug: 34681110 - Remove duplicate reference to server in cockpit Orabug: 34030494 - Update documentation links Orabug: 30271413, Orabug: 32013095,...

ghtml Cross-Site Scripting (XSS) vulnerability

Summary It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Actions Taken - Updated the documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protecti...

GHSA-VVHJ-V88F-5GXR ghtml Cross-Site Scripting (XSS) vulnerability

Summary It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Actions Taken - Updated the documentation to clarify that while ghtml escapes characters with special meaning in HTML, it does not provide comprehensive protecti...

CVE-2024-37166 ghtml Cross-Site Scripting (XSS) vulnerability

ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting XSS vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this issue. Version 2.0.0 contains updated...