Open Source Vulnerabilities

jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values

Parse Server may crash when uploading file without extension

nginx, nginx-all-modules, nginx-core, nginx-filesystem, nginx-mod-devel, nginx-mod-http-image-filter, nginx-mod-http-perl, nginx-mod-http-xslt-filter, nginx-mod-mail, nginx-mod-stream

Moderate: nginx:1.22 security update

firefox-esr, firefox-esr

firefox-esr - security update

xorg-server, xorg-server

xorg-server - security update

xorg-server

xorg-server - security update

mozjs52, mozjs38, firefox, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, mozjs102

mozjs52, mozjs38, firefox, thunderbird, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, thunderbird, mozjs102, thunderbird

mozjs52, mozjs38, firefox, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, mozjs102

mozjs52, mozjs38, firefox, thunderbird, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, thunderbird, mozjs102, thunderbird

mozjs52, mozjs38, firefox, thunderbird, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, thunderbird, mozjs102, thunderbird

mozjs52, mozjs38, firefox, thunderbird, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, thunderbird, mozjs102, thunderbird

mozjs52, mozjs38, firefox, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, mozjs102

mozjs52, mozjs38, firefox, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, mozjs102

mozjs52, mozjs38, firefox, thunderbird, mozjs68, mozjs52, mozjs102, mozjs78, mozjs91, thunderbird, mozjs102, thunderbird

xorg-server, xorg-server, xorg-server-hwe-16.04, xorg-server, xorg-server-hwe-18.04, xorg-server, xorg-server, xorg-server, xorg-server, xorg-server, xorg-server

xorg-server, xorg-server, xorg-server-hwe-16.04, xorg-server, xorg-server-hwe-18.04, xorg-server, xorg-server, xorg-server

thunderbird, thunderbird, thunderbird

xorg-server, xorg-server, xorg-server-hwe-16.04, xorg-server, xorg-server-hwe-18.04, xorg-server, xorg-server, xwayland, xorg-server, xwayland

Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

Denial of Service by publishing large messages over the HTTP API

RabbitMQ Java client's lack of message size limitation leads to remote DoS attack

Server-Side Request Forgery Vulnerability in Custom Integration Upload

Fides Information Disclosure Vulnerability in Config API Endpoint

WPS Server Side Request Forgery in GeoServer

Fides JavaScript Injection Vulnerability in Privacy Center URL

Samba: heap buffer overflow with freshness tokens in the heimdal kdc

Mercurial configuration injectable in repo revision when installing via pip

minizip, minizip-devel, zlib, zlib-devel, zlib-static

zlib: Fix of CVE-2023-45853

minizip, minizip-devel, zlib, zlib-devel, zlib-static

zlib: Fix of CVE-2023-45853

zlib, zlib-devel, zlib-static

zlib: Fix of CVE-2023-45853

zlib, zlib-devel, zlib-static

zlib: Fix of CVE-2023-45853

minizip, minizip-devel, zlib, zlib-devel, zlib-static

zlib: Fix of CVE-2023-45853

lib32z1, lib32z1-dev, libx32z1, libx32z1-dev, zlib1g, zlib1g-dev

Fix CVE(s): CVE-2023-45853

github.com/consensys/gnark

Proof forgery due to insufficient randomness in github.com/consensys/gnark

github.com/ydb-platform/ydb-go-sdk/v3

Credentials leak in github.com/ydb-platform/ydb-go-sdk/v3

github.com/nats-io/nats-server/v2

Authorization bypass in github.com/nats-io/nats-server/v2

lib32z1, lib32z1-dev, libx32z1, libx32z1-dev, zlib1g, zlib1g-dev

Fix CVE(s): CVE-2023-45853

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

github.com/jumpserver/koko, github.com/jumpserver/koko

Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell

nautobot

Nautobot vulnerable to exposure of hashed user passwords via REST API

cocoon

Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse

ncurses, ncurses, ncurses

ncurses vulnerability

org.geoserver.extension:gs-wps-core, org.geoserver.extension:gs-wps-core

WPS Server Side Request Forgery vulnerability

org.geoserver:gs-wms, org.geoserver:gs-wms, org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-app

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF

go-toolset

Important: go-toolset and golang security and bug fix update

php

Important: php security update