CVE-2025-22445 Misleading UI for undefined admin console settings in Calls causes security confusion

Mattermost versions 10.x = 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting...

Linux kernel 缓冲区错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates from an out-of-bounds array index in the AMD display driver, resulting in memory corruption and affecting...

NiceGUI On Air authentication issue

Summary Once a user logins to one browser, all other browsers are logged in without entering password. Even incognito mode. Impact high...

ZenML < 0.56.2 Vulnerability - CVE-2024-2035

The version of ZenML installed on the remote host is prior to 0.56.2. It is, therefore, affected by An improper authorization vulnerability exists in the API /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing th...

SUSE CVE-2024-56431

ochufftreeunpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash...

DEBIAN-CVE-2024-56431

ochufftreeunpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash...

Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment

A vulnerability was found in the WildFly management console. A user may perform cross-site scripting in the deployment system. An attacker or insider may execute a malicious payload which could trigger an undesired behavior against the server. Impact Cross-site scripting XSS vulnerability in the...

Important: Red Hat Bug Fix Advisory: Red Hat Quay v3.11.7 bug fix release

Red Hat Quay 3.11.7 is now available with bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in th...

edk2: Integer overflows in PeCoffLoaderRelocateImage

A flaw was found in the EDK2 package. This flaw allows an attacker to cause memory corruption due to an overflow via an adjacent network. This issue may lead to loss of confidentiality, integrity, and availability...

Important: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.1

Red Hat Trusted Profile Analyzer 1.2.1 release Red Hat Product Security has rated this update as having a security impact of Moderate Red Hat Trusted Profile Analyzer 1.2.1...

Important: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.1

Red Hat Trusted Profile Analyzer 1.2.1 release Red Hat Product Security has rated this update as having a security impact of Moderate Red Hat Trusted Profile Analyzer 1.2.1...

Welcome and About GeoServer pages communicate version and revision information

Impact The welcome and about page includes version and revision information about the software in use including library and components used. This information is sensitive from a security point of view because it allows software used by the server to be easily identified. Proof of Concept 1. Welco...

CVE-2024-54112

Huawei HarmonyOS is affected by CVE-2024-54112, a cross-process screen stack vulnerability in the UIExtension module. The root cause is a vulnerability in the UIExtension handling that can impact service confidentiality. The available documents describe the issue and its impact but do not specify...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts

s2-067-CVE-2024-53677 s2-067CVE-2024-53677 Summary File uplo...

Remote Desktop Client RCE Vulnerability (Dec 2024) - Windows

Remote Desktop Client is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ABB Cylon Aspect 3.08.02 (altlogin.php) Unauthenticated Reflected XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an unauthenticated reflected...

Foxit PhantomPDF Multiple Vulnerabilities (Dec 2024) - Windows

Foxit PhantomPDF is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:phantompdf";...

PYSEC-2024-287

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the...

GHSA-75C5-XW7C-P5PM PyJWT Issuer field partial matches allowed

Summary The wrong string if check is run for iss checking, resulting in "acb" being accepted for "abc". Details This is a bug introduced in version 2.10.0: checking the "iss" claim changed from isinstanceissuer, list to isinstanceissuer, Sequence. diff - if isinstanceissuer, list: + if...

Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to its deletion

Impact Existing lakeFS users who have issued credentials to users who have been deleted. Creating a new user with the same username, that user will inherit all of the previous user's credentials lakeFS needs to delete user credentials upon user deletion. Patches Has the problem been patched? What...