Open Source Vulnerabilities

389-ds-base, 389-ds-base-devel, 389-ds-base-legacy-tools, 389-ds-base-libs, 389-ds-base-snmp, python3-lib389

Moderate: 389-ds:1.4 security update

SLOF, hivex, hivex-devel, libguestfs, libguestfs-appliance, libguestfs-bash-completion, libguestfs-devel, libguestfs-gfs2, libguestfs-gobject, libguestfs-gobject-devel, libguestfs-inspect-icons, libguestfs-java, libguestfs-java-devel, libguestfs-javadoc, libguestfs-man-pages-ja, libguestfs-man-pages-uk, libguestfs-rescue, libguestfs-rsync, libguestfs-tools, libguestfs-tools-c, libguestfs-winsupport, libguestfs-xfs, libiscsi, libiscsi-devel, libiscsi-utils, libnbd, libnbd-bash-completion, libnbd-devel, libtpms, libtpms-devel, libvirt, libvirt-client, libvirt-daemon, libvirt-daemon-config-network, libvirt-daemon-config-nwfilter, libvirt-daemon-driver-interface, libvirt-daemon-driver-network, libvirt-daemon-driver-nodedev, libvirt-daemon-driver-nwfilter, libvirt-daemon-driver-qemu, libvirt-daemon-driver-secret, libvirt-daemon-driver-storage, libvirt-daemon-driver-storage-core, libvirt-daemon-driver-storage-disk, libvirt-daemon-driver-storage-gluster, libvirt-daemon-driver-storage-iscsi, libvirt-daemon-driver-storage-iscsi-direct, libvirt-daemon-driver-storage-logical, libvirt-daemon-driver-storage-mpath, libvirt-daemon-driver-storage-rbd, libvirt-daemon-driver-storage-scsi, libvirt-daemon-kvm, libvirt-dbus, libvirt-devel, libvirt-docs, libvirt-libs, libvirt-lock-sanlock, libvirt-nss, libvirt-wireshark, lua-guestfs, nbdfuse, nbdkit, nbdkit-bash-completion, nbdkit-basic-filters, nbdkit-basic-plugins, nbdkit-curl-plugin, nbdkit-devel, nbdkit-example-plugins, nbdkit-gzip-filter, nbdkit-gzip-plugin, nbdkit-linuxdisk-plugin, nbdkit-nbd-plugin, nbdkit-python-plugin, nbdkit-server, nbdkit-ssh-plugin, nbdkit-tar-filter, nbdkit-tar-plugin, nbdkit-tmpdisk-plugin, nbdkit-vddk-plugin, nbdkit-xz-filter, netcf, netcf-devel, netcf-libs, ocaml-hivex, ocaml-hivex-devel, ocaml-libguestfs, ocaml-libguestfs-devel, ocaml-libnbd, ocaml-libnbd-devel, perl-Sys-Guestfs, perl-Sys-Virt, perl-hivex, python3-hivex, python3-libguestfs, python3-libnbd, python3-libvirt, qemu-guest-agent, qemu-img, qemu-kvm, qemu-kvm-block-curl, qemu-kvm-block-gluster, qemu-kvm-block-iscsi, qemu-kvm-block-rbd, qemu-kvm-block-ssh, qemu-kvm-common, qemu-kvm-core, qemu-kvm-docs, qemu-kvm-hw-usbredir, qemu-kvm-tests, qemu-kvm-ui-opengl, qemu-kvm-ui-spice, ruby-hivex, ruby-libguestfs, seabios, seabios-bin, seavgabios-bin, sgabios, sgabios-bin, supermin, supermin-devel, swtpm, swtpm-devel, swtpm-libs, swtpm-tools, swtpm-tools-pkcs11, virt-dib, virt-v2v, virt-v2v-bash-completion, virt-v2v-man-pages-ja, virt-v2v-man-pages-uk

Moderate: virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

stdlib

Certificate validation bypass on Windows in crypto/x509

stdlib

Panic when decoding Float and Rat types in math/big

stdlib, golang.org/x/net

Reset flood in net/http and golang.org/x/net/http

toolchain

Incorrect access control in the go command in cmd/go/internal/modfetch

streamlit

golang-github-graph-gophers-graphql-go, golang-github-graph-gophers-graphql-go, golang-github-graph-gophers-graphql-go, golang-github-graph-gophers-graphql-go, golang-github-graph-gophers-graphql-go

User preference to prevent private discussions not respected in fof/byobu

Improper Limitation of a Pathname to a Restricted Directory in sanic

Memory allocation based on untrusted length in rust-websocket

Streamlit directory traversal vulnerability

Weakness in Transfer Validation Logic in @solana/pay

,

Unbounded gas consumption in @openzeppelin/contracts

Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls

GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts

Path traversal vulnerability in Simple Archive Format package import in DSpace

Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

Cross Site Scripting possible in DSpace JSPUI spellcheck and autocomplete tools

Path traversal vulnerabilities in DSpace JSPUI submission upload

URL Redirection to Untrusted Site in Dspace JSPUI

"Internal System Error" page in DSpace JSPUI prints exceptions and stack traces without sanitization

Metadata of withdrawn Items is exposed to anonymous users in DSpace XMLUI

mTLS client verification is skipped in fs2 on Node.js

Email activation route can be abused by spammers in Discourse

Cache poisoning via maliciously-formed request in Discourse

Remote code execution in prestashop

Leakage of excessive information into log in next-auth

Email addresses are not hidden regardless of selected state in mprweb

Insufficient escaping of line feeds for CMD in shescape

Insufficient escaping of whitespace in shescape

flask-appbuilder

Improper Authorization in eLabFTW

Possible to infer sensitive information through query strings in Flask-AppBuilder

Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

Persistent cross site scripting in customer module in Shopware

Redirection of DNS domain in eth.link domain name version 2022-07-31 and later

Fine grained permissions are not checked in Tuleap

HTTP Host Header Attack Vulnerability in laminas-diactoros