MGASA-2024-0002 Updated libssh2 packages fix a security vulnerability (Terrapin Attack)

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

Stud.IP Cross-Site Scripting Vulnerability

Stud.IP is an open source learning and information management system for universities, education and applications from Sourceforge. A cross-site scripting vulnerability exists in Stud.IP versions prior to 5.3.4, 5.2.6, 5.1.7, and 5.0.9, which stems from the fact that uploadaction, editaction in t...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2024-468)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-468 advisory. AWS is aware of CVE-2023-48795, also known as Terrapin, which is found in the SSH protocol and affects SSH channel integrity. A protocol extension has been introduced by OpenSSH which needs to be applie...

Medium: golang

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2024-477)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-477 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP clie...

Malicious code in replit-extensions-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7462f6e9b4a4fb60632168e7333f43126c172c42dbe957ea9288df7461840fa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-65 Malicious code in replit-extensions-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7462f6e9b4a4fb60632168e7333f43126c172c42dbe957ea9288df7461840fa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-21641 Flarum's Logout Route allows open redirects

Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a trusted domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be...

CVE-2024-21641 Flarum's Logout Route allows open redirects

Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a trusted domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be...

DEBIAN-CVE-2023-34327

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

CVE-2023-34328

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

CVE-2023-34328

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

ALPINE-CVE-2023-34328

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

Design/Logic Flaw

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. AMD CPUs since 2014 have extensions to normal x86 debugging functionality. Xen supports guests using these extensions. Unfortunately there are errors in Xen's handling of...

CVE-2023-34328

CVE-2023-34328 relates to Xen where a PV vCPU can place a breakpoint over the live GDT, potentially locking up the CPU. This is described in the CNA as a Xen/AMD x86 debugging state handling issue that can lead to a denial of service. The entry references XSA-156 and CVE-2015-8104 as related cont...

OESA-2024-1027 libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...

CVE-2023-51539

Cross-Site Request Forgery CSRF vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1...

CVE-2023-51539

Cross-Site Request Forgery CSRF vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1...

CVE-2023-51539

Technical details for CVE-2023-51539 are not provided in the supplied documents; no affected products, root cause, or remediation are disclosed here. Monitor for updates from vendors/security advisories.