CVE-2024-43853 affecting package kernel for versions less than 6.6.47.1-1

CVE-2024-43853 affecting package kernel for versions less than 6.6.47.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-43856 affecting package kernel for versions less than 6.6.47.1-1

CVE-2024-43856 affecting package kernel for versions less than 6.6.47.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-31951 affecting package frr for versions less than 8.5.5-1

CVE-2024-31951 affecting package frr for versions less than 8.5.5-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-35984 affecting package kernel for versions less than 6.6.35.1-4

CVE-2024-35984 affecting package kernel for versions less than 6.6.35.1-4. An upgraded version of the package is available that resolves this issue...

CVE-2024-7709

The CVE-2024-7709 affects OcoMon versions 4.0RC1/4.0/5.0RC1, where the URL Handler’s /includes/common/require_access_recovery.php performs an unknown processing that allows cross-site scripting. The public exploit and remote initiation potential are indicated, with upgrading to 4.0.1 or 5.0 addre...

GHSA-P78H-M8PV-G9GM Apereo CAS vulnerable to credential leaks for LDAP authentication

Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “sslclientcert”. When checking the validity o...

CVE-2020-16845 affecting package python-tensorboard for versions less than 2.16.2-2

CVE-2020-16845 affecting package python-tensorboard for versions less than 2.16.2-2. An upgraded version of the package is available that resolves this issue...

CVE-2021-32715 affecting package rpm-ostree for versions less than 2024.4-1

CVE-2021-32715 affecting package rpm-ostree for versions less than 2024.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-40647 Unintentional exposure of environment variables to subprocesses in sentry-sdk

sentry-sdk is the official Python SDK for Sentry.io. A bug in Sentry's Python SDK 2.8.0 allows the environment variables to be passed to subprocesses despite the env= setting. In Python's subprocess calls, all environment variables are passed to subprocesses by default. However, if you specifical...

CVE-2024-31979

Server-Side Request Forgery SSRF vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an...

CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...

CVE-2023-6237 affecting package nodejs for versions less than 20.14.0-1

CVE-2023-6237 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-37312 Nextcloud user_oidc app's ID4me feature is available even when disabled

useroidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to...

CVE-2024-36104 Apache OFBiz: Path traversal leading to a RCE

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue...

CVE-2023-45232 affecting package edk2 for versions less than 20240223gitedc6681206c1-1

CVE-2023-45232 affecting package edk2 for versions less than 20240223gitedc6681206c1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-35196

Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, i...

CVE-2024-32617 affecting package hdf5 for versions less than 1.14.4-1

CVE-2024-32617 affecting package hdf5 for versions less than 1.14.4-1. An upgraded version of the package is available that resolves this issue...

libssh security update

0.9.6-14 - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol BPP - Fix CVE-2023-6918 Missing checks for return values for digests - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection of malicious code through hostname - Note: version is bumped from 12 to 14...

CVE-2024-2757 affecting package php for versions less than 8.3.6-1

CVE-2024-2757 affecting package php for versions less than 8.3.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1

CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...