OESA-2024-1179 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial porti...

Change Table Prefix <= 2.0 - Cross-Site Request Forgery via change_prefix_form

Description The Change Table Prefix plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the 'changeprefixform' function. This makes it possible for unauthenticated attackers to toggle...

Mlflow Cross-Site Scripting Vulnerability

Mlflow is an open source platform for machine learning lifecycle. Mlflow suffers from a cross-site scripting vulnerability that stems from a lack of cleanup of dataset table fields, leading to cross-site scripting...

SUSE SLED15: abseil-cpp-devel / grpc-devel / grpc-source / libabsl2308_0_0 / etc (SUSE-SU-2024:0573-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0573-1 advisory. abseil-cpp was updated to: Update to 20230802.1: Add StdcppWaiter to the end of the list of wait...

DRUPAL-CONTRIB-2024-010

This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled...

SUSE SLES12: postgresql13 / postgresql13-contrib / postgresql13-devel / etc (SUSE-SU-2024:0541-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0541-1 advisory. Upgrade to 13.14: - CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY bsc1219679. Tenable has...

PT-2024-18002 · WordPress · Paid Membership Subscriptions

Name of the Vulnerable Software and Affected Versions: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress versions up to, and including, 2.11.1 Description: The issue is related to unauthorized modification of data due to a missin...

Warning:Table chb_State.Workers object definition does not match the expected reference schema

The Site test Report shows a warning "Table chbState.Workers object definition does not match the expected reference schema" CDF traces captured from the DDC while running the Ste test show the below messages:...

WordPress Change Table Prefix Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Change Table Prefix Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-25932 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3132be596954 Credits Nguyen Xuan Chien...

PT-2024-7722 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The vulnerability is related to the mm/debug vm pgtable component of the Linux kernel, specifically with the function pud advanced tests. It involves incorrect handling of devmap PUD p...

PT-2024-7726 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.4.0 Description: The Linux kernel has a vulnerability in the powerpc/pseries/iommu component. When the kdump kernel tries to copy dump data over SR-IOV, the LPAR panics due to a NULL pointer exception. The...

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2020, and Adobe Reader 2020 lies in their ability to read data beyond the buffer in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2020, and Adobe Reader 2020 lies in the reading of data beyond the buffer boundary in memory during the processing of the SegmentMaps table and the avar...

CVE-2023-4538

The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords. This issue affects ERP XL...

CVE-2023-4538

The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords. This issue affects ERP XL...

Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerability

Talos Vulnerability Report TALOS-2023-1905 Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerability February 15, 2024 CVE Number CVE-2024-20735 SUMMARY An out-of-bounds read vulnerability exists in the font file processing functionality of Adobe Acrobat Reader 2023.006.2038...

PT-2024-19385

Name of the Vulnerable Software and Affected Versions Mathieu Malaterre Grassroot DICOM version 3.0.23 Description A heap-based buffer overflow issue exists in the LookupTable::SetLUT functionality. This can be triggered by a specially crafted malformed file, leading to memory corruption. An...

Adobe Acrobat Reader Font CharStrings INDEX out-of-bounds read vulnerability

Talos Vulnerability Report TALOS-2023-1908 Adobe Acrobat Reader Font CharStrings INDEX out-of-bounds read vulnerability February 15, 2024 CVE Number CVE-2024-20747 SUMMARY An out-of-bounds read vulnerability exists in the font file processing functionality of Adobe Acrobat Reader 2023.006.20380. ...

CVE-2023-52429

A flaw was found in the md driver in the linux kernel. Due to a missing check for struct dmioctl.targetcount, dmtablecreate can attempt to allocate more bytes than intended, resulting in a crash...

SUSE-SU-2024:0463-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-1086: Fixed a use-after-free vulnerability inside the nftables component that could have been exploited to achieve local privilege escalation bsc1219434....

SUSE CVE-2023-52429

dmtablecreate in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to in alloctargets allocate more than INTMAX bytes, and crash, because of a missing check for struct dmioctl.targetcount...