CVE-2024-22025 affecting package nodejs for versions less than 16.20.2-4

CVE-2024-22025 affecting package nodejs for versions less than 16.20.2-4. A patched version of the package is available...

UBUNTU-CVE-2024-22423

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment...

CVE-2024-22423 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment...

CVE-2024-31453 PsiTransfer vulnerable to violation of the integrity of file distribution

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. The vulnerability...

CVE-2024-29905

Summary: CVE-2024-29905 affects DIRAC prior to version 8.0.41. During the proxy generation process (e.g., dirac-proxy-init), unauthorized users on the same machine could gain read access to the proxy for a sub-millisecond window, enabling actions as if using the original proxy. The issue is mitig...

Exploit for Incorrect Authorization in Apple Macos

CVE-2023-42860 Exploit for CVE-2023-42860https://nvd.nist.g...

CVE-2024-28234

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. A...

CVE-2024-28234

Contao is affected when BBCode is enabled for comments, allowing CSS injection via BBCode in user comments. The issue affects Contao 2.0.0 and earlier, and versions prior to 4.13.40 and 5.3.4. Patch versions are Contao 4.13.40 and 5.3.4, which fix the vulnerability. As a workaround, disable BBCod...

Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester/ IBM DevOps Test UI

Summary There is vulnerability in Eclipse Jetty used by Rational Functional TesterRFT / DevOps Test UI Test UI. RFT/Test UI has addressed the applicable CVE-2024-22201. Vulnerability Details CVEID:CVE-2024-22201 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by a flaw whe...

SUSE-SU-2024:1170-1 Security update for util-linux

This update for util-linux fixes the following issues: - CVE-2024-28085: Properly neutralize escape sequences in wall. bsc1221831...

PT-2024-23579 · Unknown · Ros2 Galactic Geochelone

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions 2 Description: An insecure logging issue allows attackers to obtain sensitive information due to inadequate security measures in the logging mechanisms. Recommendations: For ROS2 Galactic Geochelone version 2...

CVE-2024-31442 Redon-Hub has incorrect permissions on all admin related commands

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

CVE-2024-31442

CVE-2024-31442 concerns Redon Hub, a Roblox Product Delivery Bot. Pre-1.0.2 versions permit all users to execute admin commands due to a permissions misconfiguration, allowing actions like receiving products for free and deleting/creating/updating products and tags. The only non-affected command ...

CVE-2024-30269 DataEase has database configuration information exposure vulnerability

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. The vulnerability has...

SUSE-SU-2024:1165-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - Upgrade from v1.25.14 to v1.25.16 - CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. bsc1219964...

SUSE-SU-2024:1138-1 Security update for guava

This update for guava fixes the following issues: - Upgrade to guava from v30.1.1 to v32.0.1 - CVE-2023-2976: Fixed Predictable temporary files and directories used in FileBackedOutputStream. bsc1212401 - CVE-2020-8908: Fixed a bug that could allow an attacker with access to the machine to...

CVE-2024-23192

RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account...

Dell Client BIOS Privilege Escalation (DSA-2024-035)

The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by an contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation Note that Nessus has no...

CVE-2024-30254 Directory traversal allowing overwriting arbitrary files

MesonLSP is an unofficial, unendorsed language server for meson written in C++. A vulnerability in versions prior to 4.1.4 allows overwriting arbitrary files if the attacker can make the victim either run the language server within a specific crafted project or mesonlsp --full. Version 4.1.4...

CVE-2024-26806

A vulnerability was found in the spi: cadence-qspi driver in the Linux kernel, where improper system-wide suspend helper calls were made in the runtime Power Management PM hooks. This issue could lead to unintended behavior during system suspend/resume cycles. Mitigation Mitigation for this issue...