Open Source Vulnerabilities

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption

org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina

TuxCare security update for 3 packages (4 CVEs)

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% o...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

malicious website could have learned the size of a cross-origin resource that supported Range requests

firefox, firefox, firefox, firefox, firefox

Use after free in Codecs in Google Chrome prior to 101

firefox, firefox, firefox, firefox, firefox

Mozilla developers Bryce Seager van Dyk and the Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox 101

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91

firefox, firefox, firefox, firefox, firefox

attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tri...

firefox, firefox, firefox, firefox, firefox

attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tri...

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to replace was too large for the container

firefox, firefox, firefox, firefox, firefox

Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated

firefox, firefox, firefox, firefox, firefox, firefox-esr, firefox-esr, firefox-esr, firefox-esr, firefox-esr

malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks

nodejs22, nodejs22

Security update for nodejs22

knative-operator-1.24-webhook

knative-operator-1.24-webhook

org.eclipse.jetty.demos:demo-async-rest-jar, org.eclipse.jetty.demos:demo-async-rest-parent, org.eclipse.jetty.demos:demo-async-rest-server, org.eclipse.jetty.demos:demo-async-rest-webapp, org.eclipse.jetty.demos:demo-container-initializer, org.eclipse.jetty.demos:demo-jaas-webapp, org.eclipse.jetty.demos:demo-jetty-webapp, org.eclipse.jetty.demos:demo-jndi-webapp, org.eclipse.jetty.demos:demo-jsp-webapp, org.eclipse.jetty.demos:demo-mock-resources, org.eclipse.jetty.demos:demo-proxy-webapp, org.eclipse.jetty.demos:demo-simple-webapp, org.eclipse.jetty.demos:demo-spec, org.eclipse.jetty.demos:demo-spec-webapp, org.eclipse.jetty.demos:demo-web-fragment, org.eclipse.jetty.demos:demos-jetty-embedded, org.eclipse.jetty.demos:demos-parent, org.eclipse.jetty.documentation:code-examples, org.eclipse.jetty.documentation:documentation-parent, org.eclipse.jetty.documentation:jetty, org.eclipse.jetty.fcgi:fcgi-client, org.eclipse.jetty.fcgi:fcgi-parent, org.eclipse.jetty.fcgi:fcgi-server, org.eclipse.jetty.gcloud:gcloud-parent, org.eclipse.jetty.gcloud:jetty-gcloud-session-manager, org.eclipse.jetty.http2:http2-client, org.eclipse.jetty.http2:http2-common, org.eclipse.jetty.http2:http2-hpack, org.eclipse.jetty.http2:http2-http-client-transport, org.eclipse.jetty.http2:http2-parent, org.eclipse.jetty.http2:http2-server, org.eclipse.jetty.http3:http3-client, org.eclipse.jetty.http3:http3-common, org.eclipse.jetty.http3:http3-http-client-transport, org.eclipse.jetty.http3:http3-parent, org.eclipse.jetty.http3:http3-qpack, org.eclipse.jetty.http3:http3-server, org.eclipse.jetty.memcached:jetty-memcached-sessions, org.eclipse.jetty.memcached:memcached-parent, org.eclipse.jetty.osgi:jetty-httpservice, org.eclipse.jetty.osgi:jetty-osgi-alpn, org.eclipse.jetty.osgi:jetty-osgi-boot, org.eclipse.jetty.osgi:jetty-osgi-boot-jsp, org.eclipse.jetty.osgi:jetty-osgi-boot-warurl, org.eclipse.jetty.osgi:jetty-osgi-project, org.eclipse.jetty.osgi:test-jetty-osgi, org.eclipse.jetty.quic:quic-client, org.eclipse.jetty.quic:quic-common, org.eclipse.jetty.quic:quic-parent, org.eclipse.jetty.quic:quic-quiche, org.eclipse.jetty.quic:quic-quiche-common, org.eclipse.jetty.quic:quic-quiche-foreign-incubator, org.eclipse.jetty.quic:quic-quiche-jna, org.eclipse.jetty.quic:quic-server, org.eclipse.jetty.websocket:websocket-core-client, org.eclipse.jetty.websocket:websocket-core-common, org.eclipse.jetty.websocket:websocket-core-server, org.eclipse.jetty.websocket:websocket-jakarta-client, org.eclipse.jetty.websocket:websocket-jakarta-common, org.eclipse.jetty.websocket:websocket-jakarta-server, org.eclipse.jetty.websocket:websocket-jetty-api, org.eclipse.jetty.websocket:websocket-jetty-client, org.eclipse.jetty.websocket:websocket-jetty-common, org.eclipse.jetty.websocket:websocket-jetty-server, org.eclipse.jetty.websocket:websocket-parent, org.eclipse.jetty.websocket:websocket-servlet, org.eclipse.jetty:apache-jsp, org.eclipse.jetty:glassfish-jstl, org.eclipse.jetty:infinispan-common, org.eclipse.jetty:infinispan-embedded, org.eclipse.jetty:infinispan-embedded-query, org.eclipse.jetty:infinispan-parent, org.eclipse.jetty:infinispan-remote, org.eclipse.jetty:infinispan-remote-query, org.eclipse.jetty:jetty-alpn-client, org.eclipse.jetty:jetty-alpn-conscrypt-client, org.eclipse.jetty:jetty-alpn-conscrypt-server, org.eclipse.jetty:jetty-alpn-java-client, org.eclipse.jetty:jetty-alpn-java-server, org.eclipse.jetty:jetty-alpn-parent, org.eclipse.jetty:jetty-alpn-server, org.eclipse.jetty:jetty-annotations, org.eclipse.jetty:jetty-ant, org.eclipse.jetty:jetty-bom, org.eclipse.jetty:jetty-cdi, org.eclipse.jetty:jetty-client, org.eclipse.jetty:jetty-deploy, org.eclipse.jetty:jetty-hazelcast, org.eclipse.jetty:jetty-home, org.eclipse.jetty:jetty-http, org.eclipse.jetty:jetty-http-spi, org.eclipse.jetty:jetty-io, org.eclipse.jetty:jetty-jaas, org.eclipse.jetty:jetty-jaspi, org.eclipse.jetty:jetty-jmx, org.eclipse.jetty:jetty-jndi, org.eclipse.jetty:jetty-jspc-maven-plugin, org.eclipse.jetty:jetty-keystore, org.eclipse.jetty:jetty-maven-plugin, org.eclipse.jetty:jetty-nosql, org.eclipse.jetty:jetty-openid, org.eclipse.jetty:jetty-p2, org.eclipse.jetty:jetty-plus, org.eclipse.jetty:jetty-project, org.eclipse.jetty:jetty-proxy, org.eclipse.jetty:jetty-quickstart, org.eclipse.jetty:jetty-rewrite, org.eclipse.jetty:jetty-runner, org.eclipse.jetty:jetty-security, org.eclipse.jetty:jetty-server, org.eclipse.jetty:jetty-servlet, org.eclipse.jetty:jetty-servlets, org.eclipse.jetty:jetty-slf4j-impl, org.eclipse.jetty:jetty-start, org.eclipse.jetty:jetty-unixdomain-server, org.eclipse.jetty:jetty-unixsocket, org.eclipse.jetty:jetty-unixsocket-client, org.eclipse.jetty:jetty-unixsocket-common, org.eclipse.jetty:jetty-unixsocket-server, org.eclipse.jetty:jetty-util, org.eclipse.jetty:jetty-util-ajax, org.eclipse.jetty:jetty-webapp, org.eclipse.jetty:jetty-xml

TuxCare security update for 123 packages (1 CVE)

argo-workflows

Security fix for GHSA-v6h2-p8h4-qcjw applied in: argo-workflows 3.6.19-r5

argo-workflows

Security fix for GHSA-9jgg-88mc-972h applied in: argo-workflows 3.6.19-r5

argo-workflows

Security fix for GHSA-v6wh-96g9-6wx3 applied in: argo-workflows 3.6.19-r5

argo-workflows

Security fix for GHSA-64mm-vxmg-q3vj applied in: argo-workflows 3.6.19-r5

praktor: Telegram upload traversal permits persistent agent instruction injection

argo-workflows, argo-workflows

In http-proxy-middleware before 2

argo-workflows, argo-workflows

In http-proxy-middleware before 2

chromium

argo-workflows

Versions of the package cross-spawn before 6

argo-workflows

cookie is a basic HTTP cookie parser and serializer for HTTP servers

chromium

argo-workflows

NPM package `braces`, versions prior to 3

chromium

chromium

chromium

Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)

ollama, ollama

VP8L decoding in golang

chromium

chromium

chromium

chromium

chromium

chromium

chromium

chromium

chromium

chromium

chromium

chromium

chromium