CVE-2024-47208 Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Server-Side Request Forgery SSRF, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17, which fixes the issue...

CVE-2024-50150

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release refers to its parent device, but without keeping a reference to it. When registering the altmode, get a reference to the parent and put it in the...

[SECURITY] [DLA 3955-1] waitress security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3955-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 16, 2024 https://wiki.debian.org/LTS -...

MozillaThunderbird-128.4.3-1.1 on GA media (moderate)

MozillaThunderbird-128.4.3-1.1 on GA media Announcement ID: openSUSE-SU-2024:14497-1 Rating: moderate Cross-References: CVE-2024-11159 CVSS scores: CVE-2024-11159 SUSE : 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2024-11159 SUSE : 6.9...

CVE-2024-52515 Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews

Nextcloud Server is a self hosted personal cloud system. After an admin enables the default-disabled SVG preview provider, a malicious user could upload a manipulated SVG file referencing paths. If the file would exist the preview of the SVG would preview the other file instead. It is recommended...

Fedora 41 : aws (2024-7908ee39a9)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-7908ee39a9 advisory. CVE-2024-41708: Ada Web Server did not use a cryptographically secure pseudorandom number generator. AWS.Utils.Random and AWS.Utils.RandomString used...

nodejs-electron-31.7.4-1.1 on GA media (moderate)

nodejs-electron-31.7.4-1.1 on GA media Announcement ID: openSUSE-SU-2024:14494-1 Rating: moderate Cross-References: CVE-2024-10231 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

gio-branding-upstream-2.82.2-2.1 on GA media (moderate)

gio-branding-upstream-2.82.2-2.1 on GA media Announcement ID: openSUSE-SU-2024:14487-1 Rating: moderate Cross-References: CVE-2024-52533 CVSS scores: CVE-2024-52533 SUSE : 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVE-2024-52533 SUSE : 7...

CLSA-2024-1731605761 Fix of 67 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-42265 - protect the fetch of -fdfd in dodup2 from mispredictions CVE-url: https://ubuntu.com/security/CVE-2024-47669 - nilfs2: fix state management in error path of log writing function CVE-url: https://ubuntu.com/security/CVE-2023-52918 - media: pci:...

Fedora 41 : python-requests (2024-b5c6704062)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b5c6704062 advisory. Automatic update for python-requests-2.32.3-1.fc41. Changelog Wed Jun 19 2024 Lumr Balhar - 2.32.3-1 - Update to 2.32.3 rhbz2281881 - Fix for CVE-2024-35195...

Fedora 39 : xorg-x11-server-Xwayland (2024-cc2c07317b)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-cc2c07317b advisory. CVE fix for CVE-2024-9632 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 41 : iwd (2024-5d6c951b0b)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5d6c951b0b advisory. iwd 2.22: Fix issue with handling the Affinities property. Fix issue with handling ConnectedAccessPoint signal when roaming. Tenable has extracted the...

Fedora 41 : libreswan (2024-342c3cc98f)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-342c3cc98f advisory. Automatic update for libreswan-4.15-2.fc41. Changelog Sat Jun 22 2024 Paul Wouters - 4.15-2 - Add libreswan-4.15-ipsecimport.patch Sat Jun 22 2024 Paul Woute...

Fedora 41 : python3.12 (2024-750bcd7d5c)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-750bcd7d5c advisory. Automatic update for python3.12-3.12.5-1.fc41. Changelog Wed Aug 7 2024 Tom Hrniar - 3.12.5-1 - Update to 3.12.5 - Fixes: rhbz2303159 email header injection...

Fedora 41 : mosquitto (2024-0078a55acf)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0078a55acf advisory. Update to 2.0.19 ---- Fix FTBFS closes rhbz2300978 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Fedora 37 : pgadmin4 (2022-2d5a6f48e1)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2d5a6f48e1 advisory. Fix compatibility with newer python-azure-mgmt-rdbms. ---- Update to pgadmin4-6.17, see https://www.pgadmin.org/docs/pgadmin4/development/releasenotes617.htm...

DEBIAN-CVE-2024-51996

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

CVE-2024-51996 Symphony has an Authentication Bypass via RememberMe

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. Th...

CVE-2024-52305

UnoPim is an open-source Product Information Management PIM system built on the Laravel framework. A vulnerability exists in the Create User process, allowing the creation of a new admin account with an option to upload a profile image. An attacker can upload a malicious SVG file containing an...

SUSE: Security Advisory (SUSE-SU-2024:3979-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...