[SECURITY] [DLA 3949-1] ruby-saml security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3949-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA November 11, 2024 https://wiki.debian.org/LTS -...

GLSA-202411-03 : Ubiquiti UniFi: Privilege Escalation

The remote host is affected by the vulnerability described in GLSA-202411-03 Ubiquiti UniFi: Privilege Escalation A vulnerability has been discovered in Ubiquiti UniFi. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly fr...

[SECURITY] [DLA 3895-1] puredata security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3895-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 25, 2024 https://wiki.debian.org/LTS -...

CVE-2023-52290

CVE-2023-52290 affects Apache StreamPark’s streampark-console prior to version 2.1.4. The vulnerability arises from unvalidated sort field input used to build SQL queries in list pages (e.g., application pages), enabling SQL injection after an authenticated user logs in. Impact is described as da...

CVE-2023-52290 Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

Security Bulletin: IBM Resilient SOAR is vulnerable to command injection (CVE-2024-38319)

Summary It was possible for a privileged user to inject malicious commands that could be executed as another user. This issue has been addressed. Vulnerability Details CVEID:CVE-2024-38319 DESCRIPTION: IBM Security SOAR could allow an authenticated user to execute malicious code loaded from a...

CVE-2024-36119

CVE-2024-36119 affects Statamic CMS (versions 5.3.0–5.6.1) where password_confirmation data is stored in plain text in user YAML files for users registered during the affected window when using the user:register_form tag with file-based accounts. The issue’s root cause is insecure handling of pas...

[SECURITY] [DLA 3817-1] thunderbird security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3817-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort May 20, 2024 https://wiki.debian.org/LTS -...

CVE-2024-27317

Root cause: a directory traversal in archive extraction when uploaded ZIPs (jar/nar) are processed by Pulsar Functions Worker, allowing creation/modification of files outside the extraction dir. Attack surface includes Pulsar Broker when functionsWorkerEnabled=true. Affected versions span 2.4.0–2...

CVE-2024-28198

OpenOLAT contains an XXE/SSRF vulnerability in the draw.io integration that allows an attacker to read arbitrary files as the system user by manipulating HTTP requests. Affected versions are OpenOLAT prior to 18.1.6 and prior to 18.2.2. The issue is fixed in 18.1.6 and 18.2.2; users should upgrad...

Operation on a Resource after Expiration or Release

Overview Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release due to the password reset functionality. An attacker can accept an invitation for an unlimited amount of time by exploiting the lack of validation for the pending invitation's expiry...

CSZ CMS 1.3.0 Shell Upload Vulnerability

Exploit Title: CSZ CMS Version 1.3.0 Remote Command Execution Date: 23/11/2023 Exploit Author: tmrswrr Vendor Homepage: https://www.cszcms.com/ Software Link: https://www.cszcms.com/link/3https://sourceforge.net/projects/cszcms/files/latest/download Version: Version 1.3.0 Tested on:...

GHSA-3VPF-MCJ7-5H38 Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages

Impact The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being...

How to prepare for upgrading the operating system of the Citrix License Server

To upgrade the operating system of a standalone Citrix License Server...

Default configuration

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML...

Debian: Security Advisory (DLA-3479-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affected IBM Workflow for Bluemix October 2015

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8. that is used by IBM Workflow for Bluemix. These issues were disclosed as part of the IBM® SDK, Java™ Technology Edition updates in October 2015. Vulnerability Details CVEID: CVE-2015-4872 DESCRIPTION: An...

CVE-2023-0045

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR on the function speculationctrlupdate, but the IBPB is only issued on the next...

Security Bulletin: IBM Cloud Pak for Security (CP4S) is vulnerable to information disclosure (CVE-2021-39089)

Summary IBM Cloud Pak for Security CP4S could allow an authenticated user to obtain sensitive information from a specially crafted HTTP request. This has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in the Remediation/Fixes section...

[SECURITY] [DLA 3218-1] libpgjava security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-3218-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta December 03, 2022 https://wiki.debian.org/LTS -...