CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...

CVE-2023-6237 affecting package nodejs for versions less than 20.14.0-1

CVE-2023-6237 affecting package nodejs for versions less than 20.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-37312 Nextcloud user_oidc app's ID4me feature is available even when disabled

useroidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to...

CVE-2024-36104 Apache OFBiz: Path traversal leading to a RCE

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue...

CVE-2023-45232 affecting package edk2 for versions less than 20240223gitedc6681206c1-1

CVE-2023-45232 affecting package edk2 for versions less than 20240223gitedc6681206c1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-35196

Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, i...

CVE-2024-32617 affecting package hdf5 for versions less than 1.14.4-1

CVE-2024-32617 affecting package hdf5 for versions less than 1.14.4-1. An upgraded version of the package is available that resolves this issue...

libssh security update

0.9.6-14 - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol BPP - Fix CVE-2023-6918 Missing checks for return values for digests - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection of malicious code through hostname - Note: version is bumped from 12 to 14...

CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1

CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-46752 affecting package frr for versions less than 9.1-2

CVE-2023-46752 affecting package frr for versions less than 9.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2024-2757 affecting package php for versions less than 8.3.6-1

CVE-2024-2757 affecting package php for versions less than 8.3.6-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-26884 affecting package kernel for versions less than 6.6.29.1-3

CVE-2024-26884 affecting package kernel for versions less than 6.6.29.1-3. An upgraded version of the package is available that resolves this issue...

CVE-2022-3162 affecting package keda for versions less than 2.14.0-1

CVE-2022-3162 affecting package keda for versions less than 2.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-32113

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue...

CVE-2024-29969 TLS/SSL weak message authentication code ciphers are added by default for port 18082

When a Brocade SANnav installation is upgraded from Brocade SANnav v2.2.2 to Brocade SANnav 2.3.0, TLS/SSL weak message authentication code ciphers are added by default for port 18082...

CVE-2024-32474

Sentry vulnerability CVE-2024-32474: Before 24.4.1, authenticating as a superuser with a username and password leaks the password in logs under the event event : auth-index.validate_superuser. An attacker with access to the log data could use these credentials to log in as superuser. Affected are...

CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1

CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-32000

matrix-appservice-irc is a Node.js IRC bridge for the Matrix messaging protocol. matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don't have access to. As a precondition to the attack,...

CVE-2024-31391

Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will enable basic authentication and create several accounts for...