RUSTSEC-2024-0387 `opentelemetry_api` has been merged into the `opentelemetry` crate

Last release was on 2023-07-30. opentelemetryapi has been moved into the opentelemetry crate. Please use the opentelemetry crate going forward...

CentOS 9 : squid-5.5-2.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the squid-5.5-2.el9 build changelog. - DoS when processing gopher server responses CVE-2021-46784 Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2024-24747 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

Cross site request forgery (csrf)

The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific product as complete or cancel via CSRF atta...

WordPress plugin WooCommerce Pre-Orders 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

June 13, 2023-KB5027536 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10, version 1809 and Windows Server 2019

None None...

CISA Releases Two Industrial Control Systems Advisories

CISA released two Industrial Control Systems ICS advisories on April 11, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-101-01 FANUC ROBOGUIDE-HandlingPRO ICSA-20-212-04 Mitsubishi Electric Factory Automation...

Sielco Analog FM Transmitter 2.12 Remote Privilege Escalation

Summary Sielco designs and produces FM radio transmitters for professional broadcasting. The in-house laboratory develops standard and customised solutions to meet all needs. Whether digital or analogue, each product is studied to ensure reliability, resistance over time and a high standard of...

RHEL 7 : kpatch-patch (RHSA-2023:0404)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0404 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Security Fixe...

January 3, 2023, update for Office 2016 (KB5002293)

None None...

Upgrade OpenSearch to 1.3.7 to mitigate CVE-2022-42889

In BSERV-13534 commons-text usages were upgraded in the Bitbucket Webapp to mitigate against CVE-2022-42889 although Bitbucket WebApp was actually unaffected. The bundled OpenSearch should also be updated to 1.3.7 when it is released. The release date is currently scheduled for 13-Dec-2022:...

Spring Tools 4.15.1 released

Dear Spring Community, I am happy to announce the 4.15.1 release of the Spring Tools 4 for Eclipse, Visual Studio Code, and Theia. fixes and improvements Spring Boot fixed: VScode incorrectly suggests removing @Autowired annotation from methods 787 Spring Boot fixed: VScode quick fix should not...

CVE-2022-24696

Mirametrix Glance before 5.1.1.42207 released on 2018-08-30 allows a local attacker to elevate privileges. NOTE: this is unrelated to products from the glance.com and glance.net websites...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

Information Exploit Title: Local Privilege Escalation i...

CVE-2020-22876

Buffer Overflow vulnerability in quickjs.c in QuickJS, allows remote attackers to cause denial of service. This issue is resolved in the 2020-07-05 release...

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)

Update Feb 3, 2021: It has been reported that macOS, AIX, and Solaris are also vulnerable to CVE-2021-3156, and that others may also still be vulnerable. Qualys has not independently verified the exploit. Original Post: The Qualys Research Team has discovered a heap overflow vulnerability in sudo...

openSUSE Security Update : gcc7 (openSUSE-2020-2301)

This update for gcc7 fixes the following issues : - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instruction...

Security update for gcc7 (moderate)

openSUSE Security Update: Security update for gcc7 Announcement ID: openSUSE-SU-2020:2301-1 Rating: moderate References: 1150164 1161913 1167939 1172798 1178577 1178614 1178624 1178675 Cross-References: CVE-2020-13844 Affected Products: openSUSE Leap 15.2 An update that solves one vulnerability a...

PT-2020-12492

Name of the Vulnerable Software and Affected Versions MinIO versions prior to RELEASE.2020-04-23T00-58-49Z Description The issue allows for an authentication bypass in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations, such as creating new service...

August 2014 update rollup for Windows RT, Windows 8, and Windows Server 2012

August 2014 update rollup for Windows RT, Windows 8, and Windows Server 2012 The August 2014 Windows RT 8, Windows 8, and Windows Server 2012 update rollup package resolves issues, and includes performance and reliability improvements. We recommend that you apply this update rollup as part of you...