CVE-2024-49858 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-49858 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50044 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50044 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-49983 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-49983 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-53949 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Improper Authorization vulnerability in Apache Superset when FABADDSECURITYAPI is enabled disabled by default. Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue...

CVE-2024-53948

The CVE-2024-53948 entry concerns Apache Superset prior to 4.1.0, where error message generation can expose analytics metadata. This constitutes an information disclosure vector as described in multiple sources, with a fixed version 4.1.0 recommended by the advisories. Practical impact is informa...

CVE-2024-46901

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

CVE-2023-40548 affecting package shim for versions less than 15.8-5

CVE-2023-40548 affecting package shim for versions less than 15.8-5. An upgraded version of the package is available that resolves this issue...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to improper sanitization of XML body in the fromString function. Workaround Remove the LIBXMLDTDLOAD | LIBXMLDTDATTR options from $options Details XXE Injection is a type of attack against an...

CVE-2024-11498 Resource exhaustion via Stack overflow in libjxl

There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space up to 256mb is possible, maybe 512mb, potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend...

PT-2024-31737 · Apache · Apache Answer

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.4.0 Description: The issue is related to inadequate encryption strength in Apache Answer, specifically with the use of UUID v1 version for generating ids. This can cause the generated token to be predictable,...

PHP 8.2.x < 8.2.26 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.2.26. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.26 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through

Impact The HTML Parser in lxml does not properly handle context-switching for special HTML tags such as , and . This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxmlhtmlclean but may be interpreted differently by web...

Apache Tomcat 11.0.0.M23 < 11.0.0 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.0security-11 advisory. - Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the...

PT-2024-16712 · Google · Firebase Javascript Sdk

Name of the Vulnerable Software and Affected Versions: Firebase JavaScript SDK versions prior to 10.9.0 Description: The Firebase JavaScript SDK utilizes a "FIREBASE DEFAULTS" cookie to store configuration data, including an " authTokenSyncURL" field used for session synchronization. If this cook...

Apache Airflow: Sensitive configuration values are not masked in the logs by default

Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially...

CVE-2024-52007 XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...

CVE-2024-49977 affecting package kernel for versions less than 6.6.57.1-2

CVE-2024-49977 affecting package kernel for versions less than 6.6.57.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2024-47743 affecting package kernel for versions less than 6.6.56.1-5

CVE-2024-47743 affecting package kernel for versions less than 6.6.56.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-46857 affecting package kernel for versions less than 6.6.56.1-5

CVE-2024-46857 affecting package kernel for versions less than 6.6.56.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-47683 affecting package kernel for versions less than 6.6.56.1-5

CVE-2024-47683 affecting package kernel for versions less than 6.6.56.1-5. An upgraded version of the package is available that resolves this issue...