openSUSE Security Advisory (SUSE-SU-2024:3575-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-47660

In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENTWATCHED flags lazily In some setups directories can have many usually negative dentries. Hence fsnotifyupdatechilddentryflags function can take a significant amount of time. Since the bulk of this function...

CVE-2024-46871 drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Correct the defined value for AMDGPUDMUBNOTIFICATIONMAX Why & How It actually exposes '6' types in enum dmubnotificationtype. Not 5. Using smaller number to create array dmubcallback & dmubthreadoffload has...

SUSE: Security Advisory (SUSE-SU-2024:3540-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

apache-commons-io-2.17.0-2.1 on GA media (moderate)

apache-commons-io-2.17.0-2.1 on GA media Announcement ID: openSUSE-SU-2024:14387-1 Rating: moderate Cross-References: CVE-2024-47554 CVSS scores: CVE-2024-47554 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2024-47554 SUSE : 6.9...

SUSE: Security Advisory (SUSE-SU-2024:3548-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Okta Fixes Critical Vulnerability Allowing Sign-On Policy Bypass

Okta fixed a vulnerability in its Classic product that allowed attackers to bypass sign-on policies. Exploitation required valid…...

ffmpeg-7-7.1-1.1 on GA media (moderate)

ffmpeg-7-7.1-1.1 on GA media Announcement ID: openSUSE-SU-2024:14384-1 Rating: moderate Cross-References: CVE-2024-7055 CVSS scores: CVE-2024-7055 SUSE : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

CLSA-2024-1728071268 python2: Fix of CVE-2024-7592

CVE-2024-7592: fix quadratic complexity in parsing cookies with backslashes...

CLSA-2024-1728056228 gnutls: Fix of CVE-2024-28834

CVE-2024-28834: fix side-channel leak in the deterministic ECDSA...

CLSA-2024-1728055873 emacs: Fix of CVE-2022-45939

CVE-2022-45939: fix ctags local command injection vulnerability...

[SECURITY] [DLA 3910-1] e2fsprogs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3910-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk October 04, 2024 https://wiki.debian.org/LTS -...

CVE-2024-47765 Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS

Minecraft MOTD Parser is a PHP library to parse minecraft server motd. The HtmlGenerator class is subject to potential cross-site scripting XSS attack through a parsed malformed Minecraft server MOTD. The HtmlGenerator iterates through objects of MotdItem that are contained in an object of...

Vulnerabilities fixed in Draytek Vigor routers

Draytek has fixed vulnerabilities in several types of Vigor series routers. A malicious party could exploit the vulnerabilities to cause a Denial-of-Service, or perform a Cross-Site-Scripting attack, potentially gaining access to sensitive data or executing arbitrary code in the context of the...

CVE-2024-47614

The CVE-2024-47614 issue affects the Rust GraphQL server library async-graphql prior to version 7.0.10 . The vulnerability arises because it does not limit the number of directives for a field, which can lead to Service Disruption , Resource Exhaustion , and degraded User Experience . Affected so...

CVE-2024-46977

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

CVE-2024-47527 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name "hostname" parameter. This vulnerability can lead to t...

CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact

go-tuf is a Go implementation of The Update Framework TUF. The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly...

CVE-2024-46869

A flaw was found in the Linux kernel’s btintelpcie driver. This issue is caused by a failure to allocate memory for the btinteldata structure, which stores essential internal driver data for Intel Bluetooth devices, possibly leading to system instability or crashes due to uninitialized memory...

CVE-2024-47178

basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0...