WordPress Material Design Icons Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)

Software Material Design Icons Type Plugin Vulnerable versions = 0.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9024 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID df04d692c3af Credits Brian Sans-Souci...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

Singapore Police Arrest Six Hackers Linked to Global Cybercrime Syndicate

The Singapore Police Force SPF has announced the arrest of five Chinese nationals and one Singaporean man for their alleged involvement in illicit cyber activities in the country. The development comes after a group of about 160 law enforcement officials conducted a series of raids on September 9...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

SUSE SLES15 Security Update : libqt5-qtquick3d (SUSE-SU-2024:2985-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:2985-1 advisory. - CVE-2024-40724: Fixed a heap-based buffer overflow in the PLY importer class bsc1228199 - Fixed progressive anti-aliasing, which doesn't work if any...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

SUSE CVE-2024-42098

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize privatekey privatekey is overwritten with the key parameter passed in by the caller if present, or alternatively a newly generated private key. However, it is possible that the caller provides a...

DEBIAN-CVE-2024-42155

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or...

UBUNTU-CVE-2024-42155

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or...

CVE-2024-42155 s390/pkey: Wipe copies of protected- and secure-keys

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or...

CVE-2024-42155 s390/pkey: Wipe copies of protected- and secure-keys

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or...

CVE-2024-42098

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize privatekey privatekey is overwritten with the key parameter passed in by the caller if present, or alternatively a newly generated private key. However, it is possible that the caller provides a...

CVE-2024-42098 crypto: ecdh - explicitly zeroize private_key

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize privatekey privatekey is overwritten with the key parameter passed in by the caller if present, or alternatively a newly generated private key. However, it is possible that the caller provides a...

CVE-2024-42098 crypto: ecdh - explicitly zeroize private_key

In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize privatekey privatekey is overwritten with the key parameter passed in by the caller if present, or alternatively a newly generated private key. However, it is possible that the caller provides a...

urllib3: proxy-authorization request header is not stripped during cross-origin redirects

A flaw was found in urllib3, an HTTP client library for Python. In certain configurations, urllib3 does not treat the Proxy-Authorization HTTP header as one carrying authentication material. This issue results in not stripping the header on cross-origin redirects...

MAL-2024-7781 Malicious code in angular-material-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc6ec3d00f5ac0565644d0b1fce06bf68473a14b48df88761451345f12c7475c The OpenSSF Package Analysis project identified 'angular-material-panel' @ 1.1.5 npm as malicious. It is considered malicious because: - The...

Malicious code in angular-material-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc6ec3d00f5ac0565644d0b1fce06bf68473a14b48df88761451345f12c7475c The OpenSSF Package Analysis project identified 'angular-material-panel' @ 1.1.5 npm as malicious. It is considered malicious because: - The...

vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material

Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw might allow an attacker to infer some information about the secret key material through a side-channel attack. Impa...

CVE-2024-40640 Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac

vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw might allow an attacker to infer some...

CVE-2024-20323

Cisco Intelligent Node (iNode) Software is affected by CVE-2024-20323 due to hard-coded cryptographic material in the TLS setup between iNode Manager and its nodes. A remote, unauthenticated attacker in a man-in-the-middle position could use the static key to generate a trusted certificate, imper...