Open Source Vulnerabilities

shim, shim-signed, shim, shim-signed

shim, shim-signed, shim, shim-signed

WebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting

Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update

simdutf

Heap-buffer-overflow in simdutf::westmere::implementation::convert_utf8_to_utf32

libredwg

Heap-buffer-overflow in json_HEADER

frr, frr-selinux

Moderate: frr security update

tomcat, tomcat-admin-webapps, tomcat-docs-webapp, tomcat-el-3.0-api, tomcat-jsp-2.3-api, tomcat-lib, tomcat-servlet-4.0-api, tomcat-webapps

Moderate: tomcat security update

grub2-common, grub2-efi-aa64, grub2-efi-aa64-cdboot, grub2-efi-aa64-modules, grub2-efi-x64, grub2-efi-x64-cdboot, grub2-efi-x64-modules, grub2-pc, grub2-pc-modules, grub2-ppc64le, grub2-ppc64le-modules, grub2-tools, grub2-tools-efi, grub2-tools-extra, grub2-tools-minimal

Moderate: grub2 security update

python-unversioned-command, python3, python3-debug, python3-devel, python3-idle, python3-libs, python3-test, python3-tkinter

Moderate: python3.9 security update

sqlite, sqlite-devel, sqlite-libs

Moderate: sqlite security update

python3-urllib3

Moderate: python-urllib3 security update

python3-rpm, rpm, rpm-apidocs, rpm-build, rpm-build-libs, rpm-cron, rpm-devel, rpm-libs, rpm-plugin-audit, rpm-plugin-fapolicyd, rpm-plugin-ima, rpm-plugin-selinux, rpm-plugin-syslog, rpm-plugin-systemd-inhibit, rpm-sign, rpm-sign-libs

Moderate: rpm security update

xorg-server

xorg-server - security update

php-phpseclib

php-phpseclib - security update

phpseclib

phpseclib - security update

thunderbird

thunderbird - security update

processwire/processwire

Arbitrary Code Execution in Processwire

lemmy_server

Any authenticated user may obtain private message details from other users on the same instance

pimcore/admin-ui-classic-bundle

Host header injection in the password reset

pimcore/admin-ui-classic-bundle

SQL Injection in Admin download files as zip

snow

Unauthenticated Nonce Increment in snow

trillium-http, trillium-client

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in trillium-http and trillium-client

Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

trillium-http and trillium-client vulnerable to HTTP Request/Response Splitting

opera

Security update for opera

org.jenkins-ci.plugins:matrix-project

Path traversal vulnerability in Jenkins Matrix Project Plugin

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core, org.jenkins-ci.main:jenkins-core

Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

io.jenkins.plugins:gitlab-branch-source

CSRF vulnerability in Jenkins GitLab Branch Source Plugin

io.jenkins.plugins:gitlab-branch-source

Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin

io.jenkins.plugins:gitlab-branch-source

Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin

org.jenkins-ci.plugins:log-command

Arbitrary file read vulnerability in Jenkins Log Command Plugin

org.jenkins-ci.plugins:git-server

Arbitrary file read vulnerability in Git server Plugin can lead to RCE

io.jenkins.plugins:redhat-dependency-analytics

Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin