Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitr…
Update to 115.12.1 https://www.thunderbird.net/en-US/thunderbird/115.12.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/
Update to 115.12.1 https://www.thunderbird.net/en-US/thunderbird/115.12.1/releasenotes/ https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/ Update t…
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulner…
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…
Update to 2.44.2: Make gamepads visible on axis movements, and not only on button presses. Disable the gst-libav AAC decoder. Make user scripts and style sheet…
Julien Viet discovered that Netty, a Java NIO client/server socket framework, was vulnerable to allocation of resources without limits or throttling due to the…
A biased ECDSA nonce generation allowed an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. In other words…
Huy Nguy¡»'n Ph¡º¡m Nh¡ºt, and Valentin T. and Lutz Wolf of CrowdStrike, discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, …
A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv…
SSSD did not always correctly apply the GPO policy.
Cross-site scripting (XSS) vulnerabilities were discovered in Roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could allow a remote a…
Update to 115.12.0 https://www.mozilla.org/en-US/security/advisories/mfsa2024-28/ https://www.thunderbird.net/en-US/thunderbird/115.12.0/releasenotes/
Use-after-free in networking. (CVE-2024-5702) Use-after-free in JavaScript object transplant. (CVE-2024-5688) External protocol handlers leaked by timing attac…
Several vulnerabilities have been discovered in the FFmpeg multimedia framework, which could result in denial of service or potentially the execution of arbitr…
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, the bypass of s…
An integer overflow in the EXIF metadata parsing was discovered in the GStreamer media framework, which may result in denial of service or potentially the exec…
It was discovered that Jinja2 incorrectly handled certain HTML attributes that were accepted by the xmlattr filter. An attacker could use this issue to inject …
Release 1.6.7 Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313) Fix bug where HTML entities in URLs were not decoded on HTML to plain text conver…
Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes for many CVEs, including a critical remote code execution bug. https://github.…
Update cacti and cacti-spine to version 1.2.27. This includes the upstream fixes for many CVEs, including a critical remote code execution bug. https://github.…
Release 1.6.7 Makefile: Use phpDocumentor v3.4 for the Framework docs (#9313) Fix bug where HTML entities in URLs were not decoded on HTML to plain text conver…
Update to 115.11.0 https://www.mozilla.org/en-US/security/advisories/mfsa2024-23/ https://www.thunderbird.net/en-US/thunderbird/115.11.0/releasenotes/
Multiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which could result in denial of service and potentially the execut…
