Our Analyses
What it means for your servers
The security stories that matter, explained by our team — with the concrete steps to take.
The security stories that matter, explained by our team — with the concrete steps to take.
Collected every two hours from specialised publications — each link leads to the original article.
A file traversal vulnerability was discovered in src:ruby-sinatra, a popular web server often used with Ruby on Rails. We now validate that any expanded paths …
expat: a use-after-free in the doContent function in xmlparse.c (CVE-2022-40674) Fixes webrtc. References:
Several vulnerabilities were discovered in Squid, a fully featured web proxy cache, which could result in exposure of sensitive information in the cache manage…
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer if an invalid HTTP request (websocket handshake) is received. It leads to null …
Multiple vulnerabilities were discovered in squid, a Web Proxy cache CVE-2022-41317
Several security vulnerabilities were discovered in mediawiki, a website engine for collaborative work. CVE-2022-41765
Several vulnerabilities were discovered in lighttpd, a fast webserver with minimal memory footprint. CVE-2022-37797
Python could be made to redirect web traffic if its http.server received a specially crafted request.
Several security vulnerabilities were discovered in mediawiki, a website engine for collaborative work. Insufficiently escaped input text may allow a malicious…
Two security vulnerabilities were discovered in Jetty, a Java servlet engine and webserver. CVE-2022-2047
Michael Catanzaro discovered a buffer overflow in the Epiphany web browser. For the stable distribution (bullseye), this problem has been fixed in version 3.38…
Rebuild against websocket 0.26.5 for CVE-2022-35922 / RUSTSEC-2022-0035.
Rebuild against websocket 0.26.5 for CVE-2022-35922 / RUSTSEC-2022-0035.
Multiple vulnerabilities have been discovered in Apache Webserver, the worst of which could result in remote code execution.
Two security vulnerabilities were discovered in Jetty, a Java servlet engine and webserver. CVE-2022-2047
Firefox could be made to crash or run programs as your login if it opened a malicious website.
A severe security bug affected the Grafana open-source web application. Exploiting the vulnerability could allow…Serious OAuth vulnerability In Grafana Could A…
Two cross-site scripting vulnerabilities were discovered in the Django Rest Framework, a toolkit to build web APIs. For the oldstable distribution (buster), th…
Arseniy Sharoglazov discovered multiple security issues in LDAP Account Manager (LAM), a web frontend for managing accounts in an LDAP directory, which could r…
This update upgrades Thunderbird to version 91.11. * Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-20…
This update upgrades Firefox to version 91.11 ESR. * Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-20…
Firefox could be made to crash or run programs as your login if it opened a malicious website.
Several vulnerabilities were discovered in Mailman, a web-based mailing list manager. An attacker could impersonate more privileged accounts through different …
This update upgrades Thunderbird to version 91.10.0. * Mozilla: Braille space character caused incorrect sender email to be shown for a digitally signed email …
