CVE-2022-41717 affecting package sriov-network-device-plugin for versions less than 3.6.2-2

CVE-2022-41717 affecting package sriov-network-device-plugin for versions less than 3.6.2-2. An upgraded version of the package is available that resolves this issue...

Design/Logic Flaw

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected...

CVE-2024-23639 micronaut-core management endpoints vulnerable to drive-by localhost attack

Micronaut Framework is a modern, JVM-based, full stack Java framework designed for building modular, easily testable JVM applications with support for Java, Kotlin and the Groovy language. Enabled but unsecured management endpoints are susceptible to drive-by localhost attacks. While not typical ...

CVE-2024-22416 Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

pyLoad is a free and open-source Download Manager written in pure Python. The pyload API allows any API call to be made using GET requests. Since the session cookie is not set to SameSite: strict, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery CSRF attac...

CVE-2024-0569 Totolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosure

A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.83320220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to information disclosure. It is possible to...

CVE-2023-5868 affecting package postgresql for versions less than 14.10-1

CVE-2023-5868 affecting package postgresql for versions less than 14.10-1. An upgraded version of the package is available that resolves this issue...

thunderbird security update

CentOS Errata and Security Advisory CESA-2024:0027 An update for thunderbird is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

PT-2023-31526 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.6 Description: The issue concerns the storage of sensitive information in cleartext form on the App Settings page, located at "/admin/app". This could allow an attacker with access to the page to obtain the Secret...

This Week in Spring - December 12th, 2023

Hi, Spring fans! Welcome to a new installment of This Week in Spring! We've got a ton of stuff to get into, so let's dive right in! Laur Spilca and I look at how to ugprade a Spring Security 5.x application to Spring Security 6.x. Apache SkyWalking with Sheng Wu and Apache ShardingSphere with...

CVE-2023-49805 Uptime Kuma Missing Origin Validation in WebSockets

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket with Socket.io, but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting...

CVE-2023-49799 Server-Side Request Forgery in nuxt-api-party

nuxt-api-party is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to prevent the aforementioned attack. This has been recently changed to use the regular expression ^https?://, however this regular expression can be bypassed by ...

CVE-2023-39248

Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption Denial of Service vulnerability, when switches are configured with VLT and VRRP. A remote unauthenticated user can cause the network to be flooded leading to Denial of Service for actual network...

Debian: Security Advisory (DSA-5570-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Kinsing Crypto Malware Targets Linux Systems via Apache ActiveMQ Flaw

By Deeba Ahmed Patches for all affected versions of Apache ActiveMQ have been released, and clients are strongly advised to upgrade their systems. This is a post from HackRead.com Read the original post: Kinsing Crypto Malware Targets Linux Systems via Apache ActiveMQ Flaw...

DEBIAN-CVE-2022-46337

A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the attacker to execute malware which was...

CVE-2023-22115 affecting package mysql for versions less than 8.0.34-1

CVE-2023-22115 affecting package mysql for versions less than 8.0.34-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-22048 affecting package mysql for versions less than 8.0.34-1

CVE-2023-22048 affecting package mysql for versions less than 8.0.34-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-26635 affecting package memcached for versions less than 1.6.22-1

CVE-2022-26635 affecting package memcached for versions less than 1.6.22-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

Fedora 39 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2023-4f0bb4ff5e)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-4f0bb4ff5e advisory. Ruby on Rails security upgrade: https://rubyonrails.org/2023/8/22/Rails-Versions-7-0-7-2-6-1-7-6-have- been-released - incorrect file permissions on encrypte...