9631 matches found
bubblewrap and flatpak security update
An update is available for bubblewrap. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged...
Important: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.3.4 security and bug fix update
OpenShift API for Data Protection OADP 1.3.4 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
CVE-2024-50355 LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input in the device Display Name, if java script code is inside the name of the device Display Name, its can b...
CVE-2024-50355 LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input in the device Display Name, if java script code is inside the name of the device Display Name, its can b...
GHSA-4M5R-W2RQ-Q54Q LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
Summary The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code. Details User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input i...
LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
Summary The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code. Details User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input i...
UBUNTU-CVE-2024-36275
NULL pointer dereference in some IntelR OptaneTM PMem Management software versions before CRMGMT02.00.00.4040, CRMGMT03.00.00.0499 may allow a authenticated user to potentially enable denial of service via local access...
Intel Optane PMem Management security vulnerability
Intel Optane PMem Management is a memory technology from Intel Corporation USA. A security vulnerability exists in Intel Optane PMem Management that originates from a null pointer dereference. An attacker exploiting this vulnerability could cause a system denial of service...
Symphony Communication Services Hp Symphony security vulnerabilities
Symphony Communication ServicesHp Symphony is a solution from Symphony Communication ServicesHp, Inc. for connecting and liquefying financial transaction workflows. A security vulnerability exists in Symphony Communication ServicesHp Symphony that stems from the fact that when using a persistent...
CVE-2024-45878
The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 fixed in version 1.35.291, in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable to persistent Cross-Site Scripting XSS...
CVE-2024-45879: Improper Neutralization of Input During Web Page Generation
The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 fixed in version 1.35.291, in /Apps/TOPqw/QWKalkulation/QWKalkulation.aspx, is vulnerable to Cross-Site Scripting XSS. To exploit the persistent XSS vulnerability, an attacker has to be authenticated to...
CVE-2024-45878: Improper Neutralization of Input During Web Page Generation
The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 fixed in version 1.35.291, in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable to persistent Cross-Site Scripting XSS...
flatpak: Access to files outside sandbox for apps using persistent= (--persist)
A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...
CVE-2024-50601
Persistent and reflected XSS vulnerabilities in the themeMode cookie and h URL parameter of Axigen Mail Server up to version 10.5.28 allow attackers to execute arbitrary Javascript. Exploitation could lead to session hijacking, data leakage, and further exploitation via a multi-stage attack. Fixe...
CVE-2024-50601
Persistent and reflected XSS vulnerabilities in the themeMode cookie and h URL parameter of Axigen Mail Server up to version 10.5.28 allow attackers to execute arbitrary Javascript. Exploitation could lead to session hijacking, data leakage, and further exploitation via a multi-stage attack. Fixe...
UBUNTU-CVE-2024-50184
In the Linux kernel, the following vulnerability has been resolved: virtiopmem: Check device status before requesting flush If a pmem device is in a bad status, the driver side could wait for host ack forever in virtiopmemflush, causing the system to hang. So add a status check in the beginning o...
CVE-2023-52045
Studio-42 eLfinder 2.1.62 contains a filename restriction bypass leading to a persistent Cross-site Scripting XSS vulnerability...
CVE-2023-52045
Studio-42 eLfinder version 2.1.62 is vulnerable to a persistent Cross-site Scripting (XSS) vulnerability due to an improper file name sanitization that allows for a filename restriction bypass. An attacker can inject malicious scripts into web pages viewed by other users by uploading a specially ...
