nodejs:20 security update

nodejs 1:20.11.1-1 - Rebase to version 20.11.1 - Fixes: CVE-2024-21892 CVE-2024-21896 CVE-2024-22017 CVE-2024-22019 high - Fixes: CVE-2023-46809 CVE-2024-21890 CVE-2024-21891 medium nodejs-nodemon nodejs-packaging...

WordPress ELEX WooCommerce Dynamic Pricing and Discounts Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software ELEX WooCommerce Dynamic Pricing and Discounts Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31255 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4d8f4c47ac76 Credits L...

PT-2026-31495

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A use-after-free issue existed in the Navigation component of Google Chrome. This allowed a remote attacker to potentially execute arbitrary code within a sandbox environment by using a...

WordPress RapidLoad Power-Up for Autoptimize Plugin <= 2.2.11 is vulnerable to Server Side Request Forgery (SSRF)

Software RapidLoad Power-Up for Autoptimize Type Plugin Vulnerable versions = 2.2.11 Fixed in 2.2.12 OWASP Top 10 A5: Security Misconfiguration Classification Server Side Request Forgery SSRF CVE CVE-2024-31288 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID...

WordPress Classified Listing Plugin <= 3.0.4 is vulnerable to Broken Access Control

Software Classified Listing Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1352 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 21a429c4da7b Credits Francesco Carlucci...

WordPress Easy Social Share Buttons Plugin <= 9.4 is vulnerable to Broken Access Control

Software Easy Social Share Buttons Type Plugin Vulnerable versions = 9.4 Fixed in 9.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31307 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 88c85a953f3f Credits Rafie Muhammad...

WordPress AWP Classifieds Plugin <= 4.3.1 is vulnerable to Broken Access Control

Software AWP Classifieds Type Plugin Vulnerable versions = 4.3.1 Fixed in 4.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-31350 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID a2e0652e7562 Credits Abdi Pranata Required...

WordPress Modal Popup Box Plugin <= 1.5.2 is vulnerable to PHP Object Injection

Software Modal Popup Box Type Plugin Vulnerable versions = 1.5.2 Fixed in 1.5.3 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-2008 Patch priority Medium CVSS severity Medium 8.5 Developer Claim ownership PSID 963c409562cd Credits Francesco Carlucci Required privilege...

USN-6644-2: LibTIFF vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description USN-6644-1 fixed vulnerabilities in LibTIFF. This update provides the corresponding updates for Ubuntu 22.04 LTS. Original advisory details: It was discovered that LibTIFF incorrectly handled certain file...

USN-6666-1: libuv vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libuv incorrectly truncated certain hostnames. A remote attacker could possibly use this issue with specially crafted hostnames to bypass certain checks. Update Instructions: Run su...

USN-6539-1: python-cryptography vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that the python-cryptography Cipher.updateinto function would incorrectly accept objects with immutable buffers. This would result in corrupted output, contrary to expectations. This iss...

USN-6558-1: audiofile vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated system were tricked into opening a specially crafted file, an attacker could...

WordPress Oxygen Builder Plugin <= 4.9 is vulnerable to Remote Code Execution (RCE)

Software Oxygen Builder Type Plugin Vulnerable versions = 4.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote Code Execution RCE CVE CVE-2024-31380 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 4b3933c6a6e8 Credits Snicco Required privilege Contributo...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : perl-DBD-SQLite (SUSE-SU-2024:1086-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:1086-1 advisory. - rebuild against current system sqlite. bsc1218946 Tenable has extracted the preceding description block...

WordPress Themify – WooCommerce Product Filter Plugin < 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Themify – WooCommerce Product Filter Type Plugin Vulnerable versions 1.4.4 Fixed in 1.4.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-2263 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2af17750bb44 Credits...

WordPress Responsive Theme <= 5.0.2 is vulnerable to Broken Access Control

Software Responsive Type Theme Vulnerable versions = 5.0.2 Fixed in 5.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-2848 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4e54d82df723 Credits Krzysztof Zając - CERT PL...

WordPress WP-Members Plugin <= 3.4.9.2 is vulnerable to Cross Site Scripting (XSS)

Software WP-Members Type Plugin Vulnerable versions = 3.4.9.2 Fixed in 3.4.9.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1852 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 145e334b433b Credits Webbernaut Required...

WordPress WP ERP Plugin <= 1.12.9 is vulnerable to Cross Site Scripting (XSS)

Software WP ERP Type Plugin Vulnerable versions = 1.12.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0609 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 78bf5e397b34 Credits Krzysztof Zając Required...

openSUSE 15 Security Update : kanidm (openSUSE-SU-2024:0095-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0095-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

WordPress Tax Rate Upload Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

Software Tax Rate Upload Type Plugin Vulnerable versions = 2.4.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31105 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 687c051f0fb1 Credits thiennv Required privilege...