The vulnerability of the Window.open() function in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Window.open function in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the disclosure of information through improper handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Moderate: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: containers/image: digest type does not guarantee valid type CVE-2024-3727 golang: net: malformed DNS message can cause infinite...

CVE-2024-23983

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules...

CVE-2024-23983

CVE-2024-23983 concerns Ping Identity PingAccess where improper handling of canonical URL-encoding may bypass request rules. Affected component is PingAccess (central policy engine) with vulnerability enabling bypass due to URL-encoded characters not properly constrained by access rules. Public s...

CVE-2024-23983 Access rules for PingAccess may be circumvented with URL-encoded characters

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules...

ROS-20241108-01

A vulnerability in the mac80211 component of the Linux operating system kernel is related to information disclosure in the function stainfofree in net/mac80211/stainfo.c. Exploitation of the vulnerability could allow an attacker to gain access to confidential information A vulnerability in the As...

CVE-2024-10963

A flaw was found in pamaccess, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from improper handling of device information in the device management module. An attacker...

CVE-2024-51560

The CVE-2024-51560 issue affects Wave 2.0, stemming from improper exception handling for invalid inputs in a specific API endpoint that processes the userId parameter. An authenticated remote attacker could trigger error messages that leak sensitive information about the targeted system. Document...

CVE-2024-0105

NVIDIA ConnectX Firmware contains a vulnerability where an attacker may cause an improper handling of insufficient privileges issue. A successful exploit of this vulnerability may lead to denial of service, data tampering, and limited information disclosure...

The vulnerability of the MiCollab Desktop Client client of the collaborative work platform MiCollab, along with the virtual instance of the MiVoice Business Solution Virtual Instance (MiVB SVI), allows a perpetrator to execute arbitrary code.

The vulnerability of the MiCollab Desktop Client client of the MiCollab collaboration platform, as well as the virtual instance of the MiVoice Business Solution Virtual Instance MiVB SVI, is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allo...

CVE-2024-10474

Focus was incorrectly allowing internal links to utilize the app scheme used for deeplinking, which could result in links potentially circumventing some URL safety checks This vulnerability affects Focus for iOS 132...

CVE-2024-30106

CVE-2024-30106 affects HCL Connections and is caused by an IBM WebSphere Application Server error that improperly handles request data, enabling information disclosure of sensitive information. The NVD entry lists a CVSS v3.1 base score of 4.3 (MEDIUM) with Network attack vector, low privileges r...

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling...

Improper Check or Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions via to the XMLUtil::GetCharacterRef function. An attacker can cause the application to exit by triggering a reachable assertion for UINTMAX/digit. Remediation Upgrade tinyxml2 to...

java-11-openjdk security update

An update is available for java-11-openjdk. This update affects Rocky Linux 8, Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The java-11-openjdk packages provide the OpenJDK 11 Ja...

RockyLinux 8 / 9 : java-1.8.0-openjdk (RLSA-2024:8117)

The remote RockyLinux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:8117 advisory. giflib: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function CVE-2023-48161 JDK: Array indexing integer overflow 8328544 CVE-2024-2121...

Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: CVE-2024-24791: Fixed denial of service due to improper 100-continue handling bsc1227314 CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973 CVE-2024-24790: Fixed unexpected behavior from Is...

CVE-2024-48964

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning...

CVE-2024-48963

The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted project due to the improper handling of the current working directory name. Snyk recommends only scanning truste...