GHSA-93X3-M7PW-PPQM Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process

Insufficient access control in the registration and password reset process allows an attacker to reset another user's password and takeover their account, if the victim has an incomplete request pending. The exploit is only possible while the verification token is valid, i.e for 5 minutes after t...

PT-2024-25692 · Mantisbt · Mantisbt

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 2.26.2 Description: The issue is related to improper escaping of a custom field's name, allowing an attacker to inject HTML and potentially execute arbitrary JavaScript when certain conditions are met, such as...

tracker-miners security update

An update is available for tracker-miners. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Tracker is a powerful desktop-neutral first class object database,...

RLSA-2023:7712 Important: tracker-miners security update

Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker. Security Fixes: tracker-miners: sandbox escape CVE-2023-5557 For more details about the security issues, including th...

[SECURITY] [DLA 3807-1] glibc security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3807-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk May 04, 2024 https://wiki.debian.org/LTS -...

2404-segmentation-pipeline (>=0.1.0 <=1.0.0), 3deecelltracker (>=0.5.0a0 <=0.5.2a0) +2323 more potentially affected by CVE-2024-34062 via tqdm (>=4.50.0 <=4.66.2)

tqdm PYPI version =4.50.0, =0.1.0, =0.5.0a0, =0.0.3, =0.0.2, =0.0.5, =1.0.0, =2.0.0, =0.0.1b1, =0.7.1, =0.11.0 - ac-solver =0.1.0 and more Source cves: CVE-2024-34062 Source advisory: OSV:GHSA-G7VV-2V7X-GJ9P...

[SECURITY] [DLA 3806-1] distro-info-data database update

Debian LTS Advisory DLA-3806-1 [email protected] https://www.debian.org/lts/security/ Stefano Rivera May 01, 2024 https://wiki.debian.org/LTS Package : distro-info-data Version : 0.41+deb10u9 This is a routine update of the distro-info-data database for Debian LTS users. It adds Ubuntu...

Wallos SQL注入漏洞

Wallos is an open source personal subscription tracker by the individual developer Miguel Ribeiro. A SQL injection vulnerability exists in Wallos versions prior to 1.15.3, which originates from an easy SQL injection via the category and payment parameters of /subscriptions/get.php...

[SECURITY] [DLA 3796-1] mediawiki security update

Debian LTS Advisory DLA-3796-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin April 27, 2024 https://wiki.debian.org/LTS Package : mediawiki Version : 1:1.31.16-1+deb10u8 CVE ID : CVE-2023-51704 Security vulnerabilities were found in mediawiki, a website engine fo...

GHSA-M2V9-W374-5HJ9 vyper default functions don't respect nonreentrancy keys

Summary Prior to v0.3.0, default functions did not respect the @nonreentrancy decorator and the lock was not emitted. This is a known bug and was already visible in the issue tracker https://github.com/vyperlang/vyper/issues/2455, but it is being re-issued as an advisory so that tools relying on...

[SECURITY] [DLA 3793-1] openjdk-11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3793-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 22, 2024 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 5671-1] openjdk-11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5671-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 22, 2024 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5670-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5670-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 22, 2024 https://www.debian.org/security/faq -...

[SECURITY] [DLA 3790-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3790-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 19, 2024 https://wiki.debian.org/LTS -...

PT-2024-26845

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A vulnerability has been resolved in the Linux kernel, specifically in the ax25 module, which handles Amateur Radio AX.25 packet protocol. The issue is related to a netdev refcount problem. Whe...

[SECURITY] [DLA 3789-1] libdatetime-timezone-perl new timezone database

------------------------------------------------------------------------- Debian LTS Advisory DLA-3789-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 18, 2024 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3788-1] tzdata new timezone database

------------------------------------------------------------------------- Debian LTS Advisory DLA-3788-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort April 18, 2024 https://wiki.debian.org/LTS -...

Aim Code Injection Vulnerability

Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a code injection vulnerability. The vulnerability stems from the application failing to properly filter special elements of constructed code segments. An attacker could exploit the...

[SECURITY] [DSA 5657-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5657-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 12, 2024 https://www.debian.org/security/faq -...

Sneaky Credit Card Skimmer Disguised as Harmless Facebook Tracker

Cybersecurity researchers have discovered a credit card skimmer that's concealed within a fake Meta Pixel tracker script in an attempt to evade detection. Sucuri said that the malware is injected into websites through tools that allow for custom code, such as WordPress plugins like Simple Custom...