Fedora 39 : mingw-gstreamer1 / mingw-gstreamer1-plugins-bad-free / etc (2024-919bc7e512)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-919bc7e512 advisory. Update to gstreamer-1.22.9. ---- Backport fix for CVE-2024-0444. Tenable has extracted the preceding description block directly from the Fedora...

Debian: Security Advisory (DSA-5702-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-202406-06 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202406-06 GStreamer, GStreamer Plugins: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE identifiers referenced below for details. Tenable has extracted...

CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

CVE-2024-5980

The CVE-2024-5980 entry describes a path-traversal vulnerability in lightning-ai/pytorch-lightning v2.2.4 exposed via the /v1/runs API endpoint. When the LightningApp runs with the plugin_server, malicious tar.gz plugins can embed arbitrary files using path traversal, allowing writes to arbitrary...

USN-6850-1 openvpn vulnerability

It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use this issue to bypass authentication using incomplete credentials...

Jenkins plugins Multiple Vulnerabilities (2024-06-26)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Low Structs Plugin provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their...

JVN#34977158: WordPress plugins "WP Tweet Walls" and "Sola Testimonials" vulnerable to cross-site request forgery

WordPress plugins "WP Tweet Walls" and "Sola Testimonials" provided by Sola Plugins contain a cross-site request forgery vulnerability CWE-352. Impact While a user logs in to the WordPress site where the affected plugin is enabled, accessing a malicious page may make the user perform unintended...

Malicious code in delayed_plugins-airbrake (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6860 Malicious code in delayed_plugins-airbrake (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in brightbox_boxgrinder-plugins (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6794 Malicious code in brightbox_boxgrinder-plugins (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Stl.Plugins.Extensions.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Rg.Plugins.Popups.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in plugins-bot (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2377 Malicious code in flipper-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813614a0417abbf8af3d06d8e798cc8a0174675c3e5f824401b04c85b3f9992c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flipper-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813614a0417abbf8af3d06d8e798cc8a0174675c3e5f824401b04c85b3f9992c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-3062 Malicious code in @realty-front/stylelint-plugins (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-6297

Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to create new, malicious, administrator...

Multiple WordPress Plugins Compromised: Hackers Create Rogue Admin Accounts

Multiple WordPress plugins have been backdoored to inject malicious code that makes it possible to create rogue administrator accounts with the aim of performing arbitrary actions. "The injected malware attempts to create a new administrative user account and then sends those details back to the...