Mozilla Firefox < 122.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 122.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-01 advisory. - Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs show...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2024-023-01)

The version of mozilla-firefox installed on the remote host is prior to 115.7.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-023-01 advisory. - An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially...

Mozilla Firefox < 122.0

The version of Firefox installed on the remote Windows host is prior to 122.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2024-01 advisory. - Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidenc...

xorg-x11-server: SELinux unlabeled GLX PBuffer

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource as with a GetGeometry or when it creates another resource that needs to access that buffer, such as...

Critical: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.9.2 security and bug fix container updates

Red Hat Advanced Cluster Management for Kubernetes 2.9.2 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the error or succeed methods in an Avo::BaseAction subclass. An attacker can execute arbitrary scripts in the context of the user's browser session by injecting unsanitized HTML content into toast...

GitHub Enterprise Server Security Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from the presence of...

EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2023-3118)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1,...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

Code injection

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy...

CVE-2024-0310

CVE-2024-0310 affects the ENS Control browser extension (prior to 10.7.0 Update 15). The issue allows a remote attacker to alter the response header parameter to switch the content-security-policy (CSP) into report-only mode, bypassing CSP protections. Affected component: ENS Control extension; v...

Trellix Endpoint Security Cross-Site Scripting Vulnerability

Trellix Endpoint Security ENS is an endpoint security solution from FireEye Trellix USA. A cross-site scripting vulnerability exists in Trellix Endpoint Security ENS Web Control prior to version 10.7.0 Update 15, which originates from a cross-site scripting vulnerability that allows a remote...

PT-2024-15460 · Unknown · Ens Control

Name of the Vulnerable Software and Affected Versions: ENS Control browser extension versions prior to 10.7.0 Update 15 Description: A content-security-policy vulnerability allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-on...

Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager

A security flaw has been disclosed in Kyocera's Device Manager product that could be exploited by bad actors to carry out malicious activities on affected systems. "This vulnerability allows attackers to coerce authentication attempts to their own resources, such as a malicious SMB share, to...

Puma HTTP Request/Response Smuggling vulnerability

Impact Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource CPU, network bandwidth consumption. Patches The vulnerabilit...

GHSA-C2F4-CVQM-65W2 Puma HTTP Request/Response Smuggling vulnerability

Impact Prior to versions 6.4.2 and 5.6.8, puma exhibited dangerous behavior when parsing chunked transfer encoding bodies. Fixed versions limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource CPU, network bandwidth consumption. Patches The vulnerabilit...

PT-2024-1857 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 122.0.6261.57 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in Site Isolation, allowing a remote attacker to bypass content security policy...

Important: Red Hat Security Advisory: postgresql:15 security update

An update for the postgresql:15 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...