Security Bulletin: IBM Storage Protect Server is susceptible to vulnerability in Resty package for Golang Go (CVE-2023-45286).

Summary The HTTP and REST client library used in Golang Go by the IBM Storage Protect Server is vulnerable to potential exposure of sensitive information from the host system. This bulletin provides steps to mitigate these vulnerabilities. Vulnerability Details CVEID:CVE-2023-45286 DESCRIPTION: G...

UBUNTU-CVE-2024-45217

Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted...

PT-2024-39322 · WordPress · Zita Elementor Site Library

Name of the Vulnerable Software and Affected Versions: Zita Elementor Site Library plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allow...

WordPress Flexmls® IDX Plugin <= 3.14.22 is vulnerable to Cross Site Scripting (XSS)

Software Flexmls® IDX Type Plugin Vulnerable versions = 3.14.22 Fixed in 3.14.23 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8719 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8b694097c0b5 Credits kayge Required...

GHSA-H47H-MWP9-C6Q6 Possible ReDoS vulnerability in block_format in Action Mailer

There is a possible ReDoS vulnerability in the blockformat helper in Action Mailer. This vulnerability has been assigned the CVE identifier CVE-2024-47889. Impact ------ Carefully crafted text can cause the blockformat helper to take an unexpected amount of time, possibly resulting in a DoS...

CVE-2024-21217

...

PyO3 has a risk of use-after-free in `borrowed` reads from Python weak references

The family of functions to read "borrowed" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling. In PyO3 0.22.4...

GHSA-6JGW-RGMM-7CV6 PyO3 has a risk of use-after-free in `borrowed` reads from Python weak references

The family of functions to read "borrowed" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling. In PyO3 0.22.4...

CVE-2024-9676

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace...

WordPress PDF-Rechnungsverwaltung Plugin <= 0.0.1 is vulnerable to Local File Inclusion

Software PDF-Rechnungsverwaltung Type Plugin Vulnerable versions = 0.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-49287 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID e30e75b2fb5a Credits tahu.datar Required privilege...

CVE-2024-9823

A flaw was found in Jetty. The DosFilter can be exploited remotely by unauthorized users to trigger an out-of-memory condition by repeatedly sending specially crafted requests. This issue may cause a crash, leading to a denial of service. Mitigation Mitigation for this issue is either not availab...

WordPress Better Author Bio Plugin <= 2.7.10.11 is vulnerable to Cross Site Request Forgery (CSRF)

Software Better Author Bio Type Plugin Vulnerable versions = 2.7.10.11 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49229 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dd031bce3db6 Credits SOPROBRO...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-42240)

"The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42240 advisory. - In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in DB handler du...

RUSTSEC-2024-0378 Risk of use-after-free in `borrowed` reads from Python weak references

The family of functions to read "borrowed" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling. In PyO3 0.22.4...

CVE-2024-42018

An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration...

CVE-2024-45397 H2O alllows bypassing address-based access control with 0-RTT

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by...

CVE-2024-42018

An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration...

CVE-2024-42018

Summary: Atos Eviden SMC xScale prior to 1.6.6 is affected. During node initialization, configuration parameters retrieved from management nodes may embed credentials, creating potential exposure of HPC configuration secrets. A mitigation preventing access by unprivileged users exists but does no...

CVE-2024-42018

An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved from management nodes. These parameters embed credentials whose integrity and confidentiality may be important to the security of the HPC configuration...

CVE-2024-47084

Gradio (Python library) has a CORS origin validation flaw: when a request carries a cookie, the server may not validate the origin, enabling a malicious site on the client to make unauthorized requests to a locally deployed Gradio server. Reported consequences include file uploads, token theft, a...