9757 matches found
emacs: Org mode considers contents of remote files to be trusted
A flaw was found in Emacs. Org mode considers the content of remote files, such as files opened with TRAMP on remote systems, to be trusted, resulting in arbitrary code execution...
Low: tpm2-tools security update
The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module TPM 2.0 devices from user space. Security Fixes: tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the...
RHEL 9 : tpm2-tools (RHSA-2024:9424)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:9424 advisory. The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module TPM 2.0 devices from user space...
ALSA-2024:9424 Low: tpm2-tools security update
The tpm2-tools packages add a set of utilities for management and utilization of Trusted Platform Module TPM 2.0 devices from user space. Security Fixes: tpm2-tools: arbitrary quote data may go undetected by tpm2checkquote CVE-2024-29038 tpm2-tools: pcr selection value is not compared with the...
CVE-2024-45087 IBM WebSphere Application Server cross-site scripting
IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2024-45087
CVE-2024-45087 is an XSS vulnerability in IBM WebSphere Application Server 8.5 and 9.0 affecting the administrative Web UI. The issue enables a privileged user to inject arbitrary JavaScript, potentially altering functionality and leading to credentials disclosure within a trusted session. Multip...
CVE-2024-45088
CVE-2024-45088 affects IBM Maximo Asset Management 7.6.1.3 and is a stored cross-site scripting vulnerability. According to IBM and Red Hat sources, authenticated users can inject arbitrary JavaScript into the Maximo Web UI, potentially altering functionality and leading to credentials disclosure...
CVE-2024-11079
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within...
efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
...
x86/tdx: Fix "in-kernel MMIO" check
...
tpm: Clean up TPM space after command failure
...
firefox: thunderbird: Permission leak via embed or object elements
The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...
firefox: thunderbird: Permission leak via embed or object elements
The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...
firefox: thunderbird: Permission leak via embed or object elements
The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...
firefox: thunderbird: Permission leak via embed or object elements
The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...
firefox: thunderbird: Permission leak via embed or object elements
The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...
firefox: thunderbird: Permission leak via embed or object elements
The Mozilla Foundation's Security Advisory: A permission leak could occur from a trusted site to an untrusted site via embed or object elements...
MetaMask: Missing ^ Line Beginner Leads to Origin Spoofing
The vulnerability was identified in MetaMask's regex-based origin validation for endowments. Due to a missing caret ^ anchor at the beginning of the regex pattern, origin spoofing was possible. This oversight allowed malicious domains to be treated as trusted, bypassing intended security...
CVE-2024-41745
IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2024-41744
IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...