[SECURITY] [DSA 5912-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5912-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 01, 2025 https://www.debian.org/security/faq -...

CVE-2023-33199

Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error...

CVE-2025-46345 Auth0 Account Link Extension JWT Invalid Signature Validation

Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue...

CVE-2025-46345 Auth0 Account Link Extension JWT Invalid Signature Validation

Auth0 Account Link Extension is an extension aimed to help link accounts easily. Versions 2.3.4 to 2.6.6 do not verify the signature of the provided JWT. This allows the user the ability to supply a forged token and the potential to access user information without proper authorization. This issue...

Arbitrary Code Execution

Overview marimo is an A library for making reactive notebooks and apps Affected versions of this package are vulnerable to Arbitrary Code Execution due to the dynamic loading of notebooks as modules. An attacker can execute malicious code in notebooks during the loading process, potentially...

KUNBUS GmbH Revolution Pi (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could allow attackers to bypass authentication, gain unauthorized access to critical functions, and execute malicious server-side includes SSI within a web page. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...

PT-2025-18506 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A double free vulnerability has been resolved in the Linux kernel. The issue occurs in the zfcp fsf req send function, where the wrong type of integer is used to cache the FSF request...

Debian dla-4151 : golang-github-gorilla-csrf-dev - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4151 advisory. - -------------------------------------------------------------------------- Debian LTS Advisory DLA-4151-1 [email protected] https://www.debian.org/lts/security...

PT-2025-18786 · Beaver Builder Team +2 · Beaver Builder Plugin +2

Name of the Vulnerable Software and Affected Versions: Beaver Builder Plugin Starter Version versions prior to 2.9.1 Description: The Beaver Builder Plugin Starter Version for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save enabled icons function...

Debian dla-4152 : libnode-dev - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4152 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4152-1 [email protected] https://www.debian.org/lts/security/...

Debian dla-4149 : nagvis - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4149 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4149-1 [email protected]...

[SECURITY] [DLA 4148-1] vips security update

Debian LTS Advisory DLA-4148-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin April 30, 2025 https://wiki.debian.org/LTS Package : vips Version : 8.10.5-2+deb11u1 CVE ID : CVE-2025-29769 A heap-based buffer overflow was discovered in vips, an image processing...

SonicWall SMA1000 SSRF Vulnerability

A Server-side request forgery SSRF vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location.IMPORTANT: SonicWall PSIRT...

Security Bulletin: IBM WebSphere Automation is vulnerable to an arbitrary code execution (CVE-2025-27363).

Summary IBM WebSphere Automation is vulnerable to an arbitrary code execution. Vulnerability Details CVEID:CVE-2025-27363 DESCRIPTION: An out of bounds write exists in FreeType versions 2.13.0 and below newer versions of FreeType are not vulnerable when attempting to parse font subglyph structure...

CVE-2025-4001

A vulnerability has been found in scipopt scip up to 9.2.1 and classified as problematic. Affected by this vulnerability is the function main of the file examples/LOP/src/genRandomLOPInstance.c of the component File Descriptor Handler. The manipulation of the argument File leads to uncontrolled...

CVE-2025-4002

A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB and classified as problematic. Affected by this issue is the function GetDebugLogFile of the file Library/MemLogLib/BootLog.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The patch is...

Debian dla-4148 : gir1.2-vips-8.0 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4148 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4148-1 [email protected] https://www.debian.org/lts/security/...

PT-2025-18343

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.22.0-4+deb12u6 GStreamer versions prior to 1.18.4-3+deb11u5 Description A stack buffer overflow vulnerability exists in the H.265 codec parser within GStreamer. This vulnerability allows for remote code execution ...

Low: python-requests

Issue Overview: No CVE associated with this advisory Affected Packages: python-requests Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update python-requests t...

Medium: python3-requests

Issue Overview: Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to th...