Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Authentication bypass when using Jakarta Authentication API. (CVE-2024-52316) Incorrect JSP tag recycling leads to XSS. (CVE-2024-52318) References:
PHP version 8.3.14 (21 Nov 2024) CLI: Fixed bug GH-16373 (Shebang is not skipped for router script in cli-server started through shebang). (ilutov) Fixed bug G…
Security fix for CVE-2023-6237 (openssl: Excessive time spent checking invalid RSA public keys)
x86: Deadlock in vlapic_error() [XSA-462, CVE-2024-45817]
x86: Deadlock in vlapic_error() [XSA-462, CVE-2024-45817] update to xen-4.17.5
Fixes CVE-2024-45752: A vulnerability that allows users to remap keys arbitrarily. This allows all users on the system to remap a key unexpectedly to a potenti…
Fix login QR code not shown in WhatsApp web. Disable PSON by default again in GTK 3 API versions. Disable DMABuf video sink by default to prevent file descript…
Fix login QR code not shown in WhatsApp web. Disable PSON by default again in GTK 3 API versions. Disable DMABuf video sink by default to prevent file descript…
The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-lo…
multipart/form-data request tampering has been fixed in ruby-httparty, a Ruby library for using Web-based APIs and related services. For Debian 11 bullseye, th…
Support for the "strict kex" SSH extension has been backported to AsyncSSH (a Python implementation of the SSHv2 protocol) as hardening against the Terrapin at…
Memory corruption in WebGL API. (CVE-2024-6600) Race condition in permission assignment. (CVE-2024-6601) Memory corruption in thread creation. (CVE-2024-6603) …
Backport fix for CVE-2023-49528 and backport fixes for compatibility with Mesa 24.0.6+ / 24.1.4+ for VA-API
Memory corruption in WebGL API. (CVE-2024-6600) Race condition in permission assignment. (CVE-2024-6601) Memory corruption in NSS. (CVE-2024-6602) Memory corru…
Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. Update the sequoia-keystore crate to version 0.5.1. Update the sequoia-gpg-age…
Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. Update the sequoia-keystore crate to version 0.5.1. Update the sequoia-gpg-age…
Update the sequoia-openpgp crate to version 1.21.1. Addresses RUSTSEC-2024-0345. Update the sequoia-keystore crate to version 0.5.1. Update the sequoia-gpg-age…
Multiple vulnerabilities have been discovered in PuTTY, the worst of which could lead to compromised keys.
Backport fix for CVE-2024-6387 (rhbz#2294879) Backport fix for ObscureKeystrokeTiming logic error from OpenSSH 9.8
The updated packages fix security vulnerabilities: Excessive time spent checking DSA keys and parameters. (CVE-2024-4603) Use After Free with SSL_free_buffers.…
It was discovered that Jinja2 incorrectly handled certain HTML attributes that were accepted by the xmlattr filter. An attacker could use this issue to inject …
A flaw was found in the tpm2-tss package, where there was no check that the magic number in the attest is equal to the TPM2_GENERATED_VALUE. This flaw allows a…
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c. (CVE-2024-26458) Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulne…
update to 124.0.6367.78 * Critical CVE-2024-4058: Type Confusion in ANGLE * High CVE-2024-4059: Out of bounds read in V8 API * High CVE-2024-4060: Use after fr…
