Moderate: Red Hat Security Advisory: Secondary Scheduler Operator for Red Hat OpenShift 1.3.0 for RHEL 9

Secondary Scheduler Operator for Red Hat OpenShift 1.3.0 for RHEL 9 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Fedora 39 : mingw-gstreamer1 / mingw-gstreamer1-plugins-bad-free / etc (2024-919bc7e512)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2024-919bc7e512 advisory. Update to gstreamer-1.22.9. ---- Backport fix for CVE-2024-0444. Tenable has extracted the preceding description block directly from the Fedora...

Debian: Security Advisory (DSA-5702-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-202406-06 : GStreamer, GStreamer Plugins: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202406-06 GStreamer, GStreamer Plugins: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in GStreamer, GStreamer Plugins. Please review the CVE identifiers referenced below for details. Tenable has extracted...

CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

CVE-2024-5980

The CVE-2024-5980 entry describes a path-traversal vulnerability in lightning-ai/pytorch-lightning v2.2.4 exposed via the /v1/runs API endpoint. When the LightningApp runs with the plugin_server, malicious tar.gz plugins can embed arbitrary files using path traversal, allowing writes to arbitrary...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (=0.0.6), com.adq.jenkins:xml-job-to-job-dsl (>=0.1.1 <=0.1.13) +534 more potentially affected by CVE-2024-39458 via org.jenkins-ci.plugins:structs (>=1.1 <=337.v1b_04ea_4df7c8)

org.jenkins-ci.plugins:structs MAVEN version =1.1, =0.1.1, =2.33.0, =1.9.0, =2.0.1, =2.8, =2.0.12, =1.12, =1.225.v14f9e6b28f53, =1.0.2, =1.28.0, =0.6, =2.37.0, =1.0.0, =1.2.7, =1.3.2 and more Source cves: CVE-2024-39458 Source advisory: OSV:GHSA-XFX3-CR74-X3CV...

org.jenkins-ci.plugins:bitbucket-approval-filter (=1.0.0), org.jenkins-ci.plugins:bitbucket-filter-project-trait (=1.0) +1 more potentially affected by CVE-2024-39460 via org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source (>=2.2.0 <=2.4.1)

org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source MAVEN version =2.2.0, =1.0.0, =1.0.2 Source cves: CVE-2024-39460 Source advisory: OSV:GHSA-X8MF-JCMF-R79F...

USN-6850-1 openvpn vulnerability

It was discovered that OpenVPN incorrectly handled certain configurations with multiple authentication plugins. A remote attacker could possibly use this issue to bypass authentication using incomplete credentials...

Jenkins plugins Multiple Vulnerabilities (2024-06-26)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Low Structs Plugin provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their...

JVN#34977158: WordPress plugins "WP Tweet Walls" and "Sola Testimonials" vulnerable to cross-site request forgery

WordPress plugins "WP Tweet Walls" and "Sola Testimonials" provided by Sola Plugins contain a cross-site request forgery vulnerability CWE-352. Impact While a user logs in to the WordPress site where the affected plugin is enabled, accessing a malicious page may make the user perform unintended...

Malicious code in delayed_plugins-airbrake (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6860 Malicious code in delayed_plugins-airbrake (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in brightbox_boxgrinder-plugins (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6794 Malicious code in brightbox_boxgrinder-plugins (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Stl.Plugins.Extensions.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Rg.Plugins.Popups.Net (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in plugins-bot (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2377 Malicious code in flipper-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813614a0417abbf8af3d06d8e798cc8a0174675c3e5f824401b04c85b3f9992c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flipper-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813614a0417abbf8af3d06d8e798cc8a0174675c3e5f824401b04c85b3f9992c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...