Open Source Vulnerabilities
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution
org.springframework:spring-context, org.springframework:spring-core, org.springframework:spring-expression
TuxCare security update for org.springframework (3 CVEs)
org.springframework:spring-context/ org.springframework:spring-core/ org.springframework:spring-expression
TuxCare security update for org.springframework (3 CVEs)
crossplane-provider-gcp-beta-container-fips
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina
TuxCare security update for 3 packages (5 CVEs)
org.apache.tomcat.embed:tomcat-embed-core/ org.apache.tomcat:tomcat/ org.apache.tomcat:tomcat-catalina
TuxCare security update for 3 packages (5 CVEs)
USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS
USB Test: Heap-based Buffer Overflow in getSectorSize via untrusted DISK_GEOMETRY.BytesPerSector leads to RCE/DoS
org.springframework.data:spring-data-mongodb
TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)
org.springframework.data:spring-data-mongodb
TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)
drupal/core
TuxCare security update for drupal/core (1 CVE)
drupal/core
TuxCare security update for drupal/core (1 CVE)
Shopper: read-only team permissions allow administrator creation and permission escalation
Shopper: read-only team permissions allow administrator creation and permission escalation
knative-kafka-broker-1.23-controller
org.springframework.data:spring-data-keyvalue
TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)
org.springframework.data:spring-data-keyvalue
TuxCare security update for org.springframework.data:spring-data-keyvalue (1 CVE)
SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array
SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
X.Org Server RandR ChangeProviderProperty Heap Buffer Overflow
epiphany
Security update for epiphany
mtdowling/jmespath.php
TuxCare security update for mtdowling/jmespath.php (1 CVE)
mtdowling/jmespath.php
TuxCare security update for mtdowling/jmespath.php (1 CVE)
YosemiteCrew: Missing organization authorization on service and PMS library/template routes
YosemiteCrew: Missing organization authorization on service and PMS library/template routes
cadvisor
Security update for cadvisor
XWiki Pro Macros: excerpt-include title and content injection executes code
XWiki Pro Macros: excerpt-include title and content injection executes code
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure
Unverified ownership of the default Athena query result location in AWS SDK for pandas
Unverified ownership of the default Athena query result location in AWS SDK for pandas
Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices
Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments
@opentelemetry/core
TuxCare security update for @opentelemetry/core (1 CVE)
@opentelemetry/core
TuxCare security update for @opentelemetry/core (1 CVE)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
kserve-huggingfaceserver-cuda-13.3
kserve-huggingfaceserver-cuda-13.3
kserve-huggingfaceserver-cuda-13.3
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
hauler
Security update for hauler
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
com.fasterxml.jackson.core:jackson-databind
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)
