Browsershot Server-Side Request Forgery (SSRF) via setURL() Function

Versions of the package spatie/browsershot from 0.0.0 to 5.0.3 are vulnerable to Server-side Request Forgery SSRF in the setUrl function due to a missing restriction on user input, enabling attackers to access localhost and list all of its directories...

Security Bulletin: IBM Maximo Application Suite uses werkzeug-3.0.4-py3-none-any.whl, cookie-0.4.1.tgz and cross-spawn-7.0.3.tgz which is vulnerable to CVE-2024-49767, CVE-2024-49766, CVE-2024-47764 and CVE-2024-21538

Summary IBM Maximo Application Suite uses werkzeug-3.0.4-py3-none-any.whl, cookie-0.4.1.tgz and cross-spawn-7.0.3.tgz which is vulnerable to CVE-2024-49767, CVE-2024-49766, CVE-2024-47764 and CVE-2024-21538. This bulletin contains information regarding the vulnerability and its fixture...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure due to improper handling of property access on reflection types and static properties/fields. An attacker can list installed nuget packages' names and versions through attributes and base types they require by...

CVE-2024-50234 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50234 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

EulerOS Virtualization 2.12.1 : bind (EulerOS-SA-2024-2747)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname of any RTYPE can suffer...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to invalid values that contain a specific set of characters. Note: This is only vulnerable if a user opens a page on which a paragraph widget is rendered. Details Cross-site scripting or XSS is a code...

Oracle Linux 8 : thunderbird (ELSA-2024-4635)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-4635 advisory. 115.13.0-3.0.1 - Add Oracle prefs file 115.13.0 - Add OpenELA debranding 115.13.0-3 - Update to 115.13.0 build5 115.13.0-2 - Update to 115.13.0 build3...

CVE-2024-21583

Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/aut...

CVE-2024-21523

All versions of the package images are vulnerable to Denial of Service DoS due to providing unexpected input types to several different functions. This makes it possible to reach an assert macro, leading to a process crash. Note: By providing some specific integer values like 0 to the size...

AZL-42031 CVE-2024-27018 affecting package hyperv-daemons for versions less than 5.15.158.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: skip conntrack input hook for promisc packets For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaroun...

AZL-39520 CVE-2024-28182 affecting package rust for versions less than 1.68.0-1

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK...

GHSA-547X-748V-VP6P Dash apps vulnerable to Cross-site Scripting

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

GHSA-3QF9-QXFJ-4WHC Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2023-36792: .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update thei...

Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update thei...

GHSA-H7JM-G87P-5935 Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2023-36796: .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update thei...

CVE-2023-36054 affecting package krb5 for versions less than 1.19.4-2

CVE-2023-36054 affecting package krb5 for versions less than 1.19.4-2. A patched version of the package is available...

AZL-34636 CVE-2022-47673 affecting package crash for versions less than 8.0.4-4

An issue was discovered in Binutils addr2line before 2.39.3, function parsemodule contains multiple out of bound reads which may cause a denial of service or other unspecified impacts...

GHSA-485R-RP8V-998V Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2023-33127: .NET Remote Code Execution Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0 and .NET 6.0. This advisory also provides guidance on what developers can do to update thei...

CVE-2022-25936

Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable...

.NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2023-21538: .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0. This advisory also provides guidance on what developers can do to update their applications to...