ALSA-2025:1659 Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: mm: migrate: fix getting incorrect page mapping during page migration CVE-2023-52490 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

Summary Problem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. Details In the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...

CVE-2024-13609

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...

CVE-2024-13555

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible for...

CVE-2024-13555

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible for...

CVE-2024-13609

The CVE-2024-13609 issue affects the WordPress plugin “1 Click WordPress Migration Plugin.” All versions up to and including 2.2 are reported vulnerable to Sensitive Information Exposure via the class-ocm-backup.php, enabling unauthenticated attackers to access usernames and password hashes durin...

CVE-2024-13609 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...

CVE-2024-13555

CVE-2024-13555 – The 1 Click WordPress Migration Plugin (up to v2.1) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation in cancel_actions(). This can allow unauthenticated attackers to cancel a backup triggered by a site administrator via a forged request. No pu...

WordPress plugin 1 Click WordPress Migration Plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

WordPress plugin 1 Click WordPress Migration Plugin 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. An information disclosure...

WordPress 1 Click WordPress Migration plugin <= 2.2 - Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php vulnerability

Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php vulnerability discovered by Joshua Provoste in WordPress Plugin 1 Click WordPress Migration versions = 2.2...

WordPress 1 Click WordPress plugin <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation vulnerability

Cross-Site Request Forgery to Backup Process Cancellation vulnerability discovered by Joshua Provoste in WordPress Plugin 1 Click WordPress Migration versions = 2.2...

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation

Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible...

CVE-2024-27138

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue...

Security update for SUSE Manager Client Tools

This update fixes the following issues: salt: Build all python bindings for all flavors Fixed the condition of alternatives for Tumbleweed and Leap 16 Handle logger exception when flushing already closed file Included passlib as a recommended dependency Make minion reconnecting on changing master...

Security update for SUSE Manager Client Tools

This update fixes the following issues: salt: Revert setting SELinux context for minion service bsc1233667 Removed System V init support Fix the condition of alternatives for Tumbleweed and Leap 16 Build all python bindings for all flavors Make minion reconnecting on changing master IP bsc1228182...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close callback in vasvmops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migration to unmap the paste address if the window...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Corrected the migration DMA map direction The SVM DMA device map direction should be set the same as the DMA unmap setting; otherwise, the DMA core will report the following warning. Before finalizing this solution,...

kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof

In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in allocpagesbulknoprof We triggered a NULL pointer dereference for ac.preferredzoneref-zone in allocpagesbulknoprof when the task is migrated between cpusets. When cpuset is enabled, in...

kernel: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof

In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in allocpagesbulknoprof We triggered a NULL pointer dereference for ac.preferredzoneref-zone in allocpagesbulknoprof when the task is migrated between cpusets. When cpuset is enabled, in...