kernel: io_uring/rw: defer fsnotify calls to task context

A locking context violation was found in the Linux kernel's iouring subsystem. The fsnotify calls were being made directly from kiocb completion context, which can execute in soft or hard IRQ context. This causes lockdep warnings when fsnotify attempts memory allocation with GFPKERNEL flags, whic...

kernel: Linux kernel: Denial of Service in mlx5e due to incorrect encap attribute handling

A flaw was found in the mlx5e Traffic Control TC encapsulation logic in the net/mlx5e driver of the Linux kernel. The code responsible for invalidating encapsulation actions did not use the proper helper function to retrieve the correct encapsulation attribute, instead assuming the default...

kernel: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()

A use-after-free flaw was discovered in the ath9k USB Wi-Fi driver in the Linux kernel. During the disconnect and deinitialization sequence ath9khifusbdisconnect, the driver could attempt to access its private data drvpriv after it has already been freed by the hardware teardown call...

kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx

A flaw was identified in the Linux kernel’s ath9k wireless driver where the receiver packet handling code did not correctly validate the length of incoming SKBs before accessing subsequent fields expected to be present. In certain malformed packet conditions e.g., pktlen set too small, the driver...

kernel: net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()

An uninitialized memory access flaw was found in the Linux kernel's QRTR Qualcomm IPC Router protocol in the transmit resume handling. When processing RESUMETX messages, if the packet size is smaller than the expected control structure, the qrtrtxresume function reads uninitialized memory from th...

kernel: ASoC: soc-compress: Reposition and add pcm_mutex

A locking issue was found in the ASoC ALSA SoC compressed audio subsystem in the Linux kernel. When DPCM Dynamic PCM compressed streams are started, several functions access resources without properly holding the card-pcmmutex lock. This triggers lock assertion warnings and can cause kernel panic...

OPENSUSE-SU-2023:0345-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Update to version 1.6.4 boo1216429: CVE-2023-5631: Fix cross-site scripting vulnerability in handling of SVG in HTML messages Fix PHP8 warnings Fix default 'mime.types' path on Windows Managesieve: Fix javascript error when relational or...

The vulnerability of the Jenkins Warnings Plugin, related to the disclosure of information, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Jenkins Warnings Plugin is related to the disclosure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

GHSA-66HV-FHCM-7XM7 Jenkins Warnings Plugin exposures system-scoped credentials

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are no...

Jenkins Warnings Plugin exposures system-scoped credentials

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are no...

CVE-2023-5727

The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox 119,...

CVE-2023-46651

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1...

CVE-2023-46651

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1...

Design/Logic Flaw

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1...

CVE-2023-46651

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1...

CVE-2023-46651

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1...

CVE-2023-46651

Affected software: Jenkins Warnings Plugin, version 10.5.0 and earlier (backport fix to 10.4.1). Vulnerability: The plugin does not set the appropriate context for credentials lookup, allowing users with Item/Configure permission to access credentials they are not entitled to. Impact: Potential u...

CVE-2023-46651

Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to. This fix has been backported to 10.4.1...

PT-2023-6484 · Jenkins · Jenkins Warnings Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Plugin versions 10.5.0 and earlier Description: The issue is related to information disclosure, allowing remote attackers to gain unauthorized access to protected information. Specifically, it does not set the appropriate...

Jenkins Plugin Warnings Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...