[SECURITY] [DLA 3900-1] ruby-httparty security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3900-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 28, 2024 https://wiki.debian.org/LTS -...

CVE-2024-46848

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Limit the period on Haswell Running the ltp test cve-2015-3290 concurrently reports the following warnings. perfevents: irq loop stuck! WARNING: CPU: 31 PID: 32438 at arch/x86/events/intel/core.c:3174...

SUSE CVE-2024-47197

Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype...

PT-2024-39356 · WordPress · Osm – Openstreetmap

Name of the Vulnerable Software and Affected Versions: OSM – OpenStreetMap plugin for WordPress versions up to, and including, 6.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's osm map and osm map v3 shortcodes due to insufficient input sanitization and outpu...

PT-2024-32419 · Gotenna · Gotenna Pro App

Name of the Vulnerable Software and Affected Versions: goTenna Pro App versions prior to the current app version Description: The issue concerns the lack of encryption for callsigns in messages. This could potentially reveal sensitive information about users and may be leveraged for other...

PT-2024-38080 · National Keep Cyber Security Services · Cybermath

Name of the Vulnerable Software and Affected Versions: CyberMath versions before CYBM.240816253 Description: The issue affects National Keep Cyber Security Services' CyberMath, allowing external parties to access files or directories and collect data from common resource locations. Recommendation...

PT-2024-32458 · Nix +3 · Nix +3

Name of the Vulnerable Software and Affected Versions: Nix versions 1.11 through 2.18.7 Nix versions 1.11 through 2.24.7 Description: The issue is related to the Nix package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, did not verify...

PT-2024-32551 · WordPress · Stuart Wilson Joy Of Text Lite

Name of the Vulnerable Software and Affected Versions: Stuart Wilson Joy Of Text Lite versions 2.3.1 and earlier Description: A Missing Authorization issue is present in Stuart Wilson Joy Of Text Lite, allowing for unauthorized access. This issue impacts the plugin up to version 2.3.1 on WordPres...

[SECURITY] [DLA 3895-1] puredata security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3895-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 25, 2024 https://wiki.debian.org/LTS -...

CVE-2024-40761 Apache Answer: Avatar URL leaked user email addresses

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead. Users are recommend...

PT-2024-38934 · Telerik · Telerik Ui For Wpf

Name of the Vulnerable Software and Affected Versions: Telerik UI for WPF versions prior to 2024 Q3 2024.3.924 Description: The issue is related to an insecure deserialization vulnerability, which allows for a code execution attack. This vulnerability can be exploited remotely. Recommendations: F...

PT-2024-32516 · Unknown · Use Any Font

Name of the Vulnerable Software and Affected Versions: Use Any Font versions n/a through 6.3.08 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For versions n/a through 6.3.08, update to a version later than 6.3....

CVE-2024-39928 Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability

In Apache Linkis = 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue...

PT-2024-39196 · WordPress · Xt Ajax Add To Cart For Woocommerce

Name of the Vulnerable Software and Affected Versions: XT Ajax Add To Cart for WooCommerce plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

PT-2024-31672 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions prior to 10.1.1 Description: A stored Cross-Site Scripting XSS issue exists in the "/modern/contacts/print" endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code ...

Planet Fitness Workouts mobile apps do not properly validate TLS certificates

RISK EVALUATION The Planet Fitness Workouts iOS and Android mobile apps are vulnerable to network attacks due to improper TLS certificate validation, allowing an attacker to obtain session tokens and sensitive information. This issue was fixed in version 9.8.12. 2. RECOMMENDED PRACTICES Upgrade...

PT-2024-39310 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent versions prior to build 38565 Description: The issue is related to local active protection service settings manipulation due to unnecessary privileges assignment, which could lead to potential system...

CVE-2024-42323 Apache HertzBeat: RCE by snakeYaml deser load malicious xml

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat incubating. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat incubating: before 1.6.0. Users are recommended to upgrade to version 1.6.0, which fixes the issue...

SUSE CVE-2024-45614

Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies such as X-Forwarded-For by providing a underscore version of the same header X-ForwardedFor. Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now...

PT-2024-29872

Name of the Vulnerable Software and Affected Versions Apache HertzBeat incubating versions prior to 1.6.0 Description The software is susceptible to a remote code execution issue stemming from a malicious XML deserialization flaw within the SnakeYaml component. This issue can only be exploited by...