oss-security mailing list
Recent messages:
- 2024/12/09 #4:
CVE-2024-53949: Apache Superset: Lower privilege users are able to
create Role when FAB_ADD_SECURITY_API is enabled (Daniel Gaspar <dpgaspar@...che.org>)
- 2024/12/09 #3:
CVE-2024-53948: Apache Superset: Error verbosity exposes metadata
in analytics databases (Daniel Gaspar <dpgaspar@...che.org>)
- 2024/12/09 #2:
CVE-2024-53947: Apache Superset: Improper SQL authorisation, parse
not checking for specific postgres functions (Daniel Gaspar <dpgaspar@...che.org>)
- 2024/12/09 #1:
[SECURITY][ANNOUNCE] Apache Subversion 1.14.5 released (Daniel Sahlberg <dsahlberg@...che.org>)
- 2024/12/06 #1:
Fwd: [Security-announce][CVE-2024-12254] Unbounded memory buffering
in SelectorSocketTransport.writelines() (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2024/12/04 #3:
Django CVE-2024-53907 and CVE-2024-53908 (Sarah Boyce <sarahboyce@...ngoproject.com>)
- 2024/12/04 #2:
CVE-2022-41137: Apache Hive: Deserialization of untrusted data
when fetching partitions from the Metastore (Stamatis Zampetakis <zabetak@...che.org>)
- 2024/12/04 #1:
Re: Local Privilege Escalations in needrestart (Jakub Wilk <jwilk@...lk.net>)
- 2024/12/03 #1:
[OSSA-2024-005] Neutron: Authorization bypassed when setting tags on
Neutron networks (CVE-2024-53916) (Jay Faulkner <jay@....cc>)
- 2024/12/02 #1:
CVE-2024-45106: Apache Ozone: Improper authentication when
generating S3 secrets (Ethan Rose <erose@...che.org>)
- 2024/12/01 #1:
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c:
sco_sock_connect() (tianshu qiu <jimuchutianshu97@...il.com>)
- 2024/11/30 #6:
Re: Linux: Race can lead to UAF in
net/bluetooth/sco.c: sco_sock_connect() (Jeroen Roovers <jer@...all.nl>)
- 2024/11/30 #5:
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c:
sco_sock_connect() (tianshu qiu <jimuchutianshu97@...il.com>)
- 2024/11/30 #4:
Re: Local Privilege Escalations in needrestart (Salvatore Bonaccorso <carnil@...ian.org>)
- 2024/11/30 #3:
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (Solar Designer <solar@...nwall.com>)
- 2024/11/30 #2:
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (tianshu qiu <jimuchutianshu97@...il.com>)
- 2024/11/30 #1:
Re: Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (Luiz Augusto von Dentz <luiz.dentz@...il.com>)
- 2024/11/29 #3:
stalld: unpatched fixed temporary file use and other issues (Matthias Gerstner <mgerstner@...e.de>)
- 2024/11/29 #2:
Re: tuned: local root exploit in D-Bus method
instance_create and other issues in tuned >= 2.23 (CVE-2024-52336,
CVE-202… (Matthias Gerstner <mgerstner@...e.de>)
- 2024/11/29 #1:
Linux: Race can lead to UAF in net/bluetooth/sco.c: sco_sock_connect() (Solar Designer <solar@...nwall.com>)
- 2024/11/28 #3:
CVE-2024-52338: Apache Arrow R package: Arbitrary code execution
when loading a malicious data file (Dewey Dunnington <paleolimbot@...che.org>)
- 2024/11/28 #2:
Re: tuned: local root exploit in D-Bus method
instance_create and other issues in tuned >= 2.23 (CVE-2024-52336,
CVE-2024-523… (Simon McVittie <smcv@...ian.org>)
- 2024/11/28 #1:
tuned: local root exploit in D-Bus method instance_create and other
issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-523… (Matthias Gerstner <mgerstner@...e.de>)
- 2024/11/27 #3:
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
- 2024/11/27 #2:
WebKitGTK and WPE WebKit Security Advisory WSA-2024-0007 (Adrian Perez de Castro <aperez@...lia.com>)
- 2024/11/27 #1:
authentik: remote timing attack in MetricsView HTTP Basic Auth
(CVE-2024-52307) (Matthias Gerstner <mgerstner@...e.de>)
- 2024/11/26 #6:
Re: Local Privilege Escalations in needrestart (Mark Esler <mark.esler@...onical.com>)
- 2024/11/26 #5:
CVE-2024-51569: Apache NimBLE: Lack of input sanitization leading
to out-of-bound reads in Number of Completed Packets HCI event … (Szymon Janc <janc@...che.org>)
- 2024/11/26 #4:
CVE-2024-47250: Apache NimBLE: Lack of input validation in HCI
advertising report could lead to potential out-of-bound access (Szymon Janc <janc@...che.org>)
- 2024/11/26 #3:
CVE-2024-47249: Apache NimBLE: Lack of input sanitization leading
to out-of-bound reads in multiple advertisement handler (Szymon Janc <janc@...che.org>)
- 2024/11/26 #2:
CVE-2024-47248: Apache NimBLE: Buffer overflow in NimBLE MESH
Bluetooth stack (Szymon Janc <janc@...che.org>)
- 2024/11/26 #1:
Re: Article: State of Sandboxing in Linux (Ali Polatel <alip@...sys.org>)
- 2024/11/25 #5:
Re: Article: State of Sandboxing in Linux (Evan Carroll <me@...ncarroll.com>)
- 2024/11/25 #4:
Re: Article: State of Sandboxing in Linux (Ali Polatel <alip@...sys.org>)
- 2024/11/25 #3:
Re: Article: State of Sandboxing in Linux (Ali Polatel <alip@...sys.org>)
- 2024/11/25 #2:
Re: Article: State of Sandboxing in Linux (Eli Schwartz <eschwartz@...too.org>)
- 2024/11/25 #1:
Re: Article: State of Sandboxing in Linux (Evan Carroll <me@...ncarroll.com>)
- 2024/11/24 #1:
Re: Article: State of Sandboxing in Linux (Mickaël Salaün <mic@...ikod.net>)
- 2024/11/22 #1:
CVE-2024-45719: Apache Answer: Predictable Authorization Token
Using UUIDv1 (Enxin Xie <linkinstar@...che.org>)
- 2024/11/20 #2:
CVE-2024-52067: Apache NiFi: Potential Insertion of Sensitive
Parameter Values in Debug Log (David Handermann <exceptionfactory@...che.org>)
- 2024/11/20 #1:
[kubernetes] CVE-2024-10220: Arbitrary command execution through
gitRepo volume (Craig Ingram <cjingram@...gle.com>)
- 2024/11/19 #1:
Local Privilege Escalations in needrestart (Qualys Security Advisory <qsa@...lys.com>)
- 2024/11/18 #6:
Fwd: wget-1.25.0 released [fixes CVE-2024-10524] (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2024/11/18 #5:
CVE-2024-31141: Apache Kafka Clients: Privilege escalation to
filesystem read-access via automatic ConfigProvider (Greg Harris <gharris@...che.org>)
- 2024/11/18 #4:
CVE-2024-52318: Apache Tomcat: Incorrect JSP tag recycling leads to
XSS (Mark Thomas <markt@...che.org>)
- 2024/11/18 #3:
CVE-2024-52317: Apache Tomcat: Request/response mix-up with HTTP/2 (Mark Thomas <markt@...che.org>)
- 2024/11/18 #2:
CVE-2024-52316: Apache Tomcat: Authentication bypass when using
Jakarta Authentication API (Mark Thomas <markt@...che.org>)
- 2024/11/18 #1:
Re: shell wildcard expansion (un)safety (Sean Whitton <spwhitton@...hitton.name>)
- 2024/11/17 #1:
Re: PostgreSQL: 4 CVEs fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 (Solar Designer <solar@...nwall.com>)
- 2024/11/16 #7:
PostgreSQL: 4 CVEs fixed in 17.1, 16.5, 15.9, 14.14, 13.17, 12.21 (Solar Designer <solar@...nwall.com>)
- 2024/11/16 #6:
CVE-2024-41151: Apache HertzBeat: RCE by notice template injection
vulnerability (Chao Gong <gongchao@...che.org>)
- 2024/11/16 #5:
CVE-2024-45791: Apache HertzBeat: Exposure sensitive token via
http GET method with query string (Chao Gong <gongchao@...che.org>)
- 2024/11/16 #4:
CVE-2024-45505: Apache HertzBeat (incubating): Exists Native Deser
RCE and file writing vulnerabilities (Chao Gong <gongchao@...che.org>)
- 2024/11/16 #3:
CVE-2024-47208: Apache OFBiz: URLs allowing remote use of Groovy
expressions, leading to RCE (Jacques Le Roux <jleroux@...che.org>)
- 2024/11/16 #2:
CVE-2024-48962: Apache OFBiz: Bypass SameSite restrictions with
target redirection using URL parameters (SSTI and CSRF lea… (Jacques Le Roux <jleroux@...che.org>)
- 2024/11/16 #1:
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
- 2024/11/15 #1:
CVE-2024-45784: Apache Airflow: Sensitive configuration values are
not masked in the logs by default (Ephraim Anierobi <ephraimanierobi@...che.org>)
- 2024/11/13 #2:
Multiple vulnerabilities in Jenkins plugins (Daniel Beck <ml@...kweb.net>)
- 2024/11/13 #1:
[ANNOUNCE] Apache Traffic Server is vulnerable to specific user inputs (Masakazu Kitajo <maskit@...che.org>)
- 2024/11/12 #11:
CVE-2024-52533: Buffer overflow in socks proxy code in glib < 2.82.1 (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2024/11/12 #10:
Re: Xen Security Advisory 464 v2 (CVE-2024-45819) -
libxl leaks data to PVH guests via ACPI tables (Demi Marie Obenour <demi@...isiblethingslab.com>)
- 2024/11/12 #9:
Re: shell wildcard expansion (un)safety (Ali Polatel <alip@...sys.org>)
- 2024/11/12 #8:
Re: 4 recent security bugs in GNOME's libsoup (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2024/11/12 #7:
Re: Xen Security Advisory 464 v2 (CVE-2024-45819) -
libxl leaks data to PVH guests via ACPI tables (Andrew Cooper <andrew.cooper3@...rix.com>)
- 2024/11/12 #6:
RE: CVE-2024-36905: Linux kernel: Divide-by-zero on
shutdown of TCP_SYN_RECV sockets (Joel GUITTET <jguittet.opensource@...ekio.com>)
- 2024/11/12 #5:
Re: CVE-2024-36905: Linux kernel: Divide-by-zero on
shutdown of TCP_SYN_RECV sockets (Clemens Lang <cllang@...hat.com>)
- 2024/11/12 #4:
Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets (Solar Designer <solar@...nwall.com>)
- 2024/11/12 #3:
CVE-2024-50386: Apache CloudStack: Directly downloaded templates
can be used to abuse KVM-based infrastructure (Daniel Augusto Veronezi Salvador <gutoveronezi…)
- 2024/11/12 #2:
Xen Security Advisory 463 v2 (CVE-2024-45818) - Deadlock in x86
HVM standard VGA handling (Xen.org security team <security@....org>)
- 2024/11/12 #1:
Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data
to PVH guests via ACPI tables (Xen.org security team <security@....org>)
- 2024/11/10 #4:
Re: shell wildcard expansion (un)safety (Fay Stegerman <flx@...usk.net>)
- 2024/11/10 #3:
Re: shell wildcard expansion (un)safety (Jeroen Roovers <jer@...all.nl>)
- 2024/11/10 #2:
Re: shell wildcard expansion (un)safety (lists@...atla.org.uk)
- 2024/11/10 #1:
Re: shell wildcard expansion (un)safety (Eli Schwartz <eschwartz@...too.org>)
- 2024/11/09 #2:
4 recent security bugs in GNOME's libsoup (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2024/11/09 #1:
Re: shell wildcard expansion (un)safety (Dominik Czarnota <dominik.b.czarnota@...il.com>)
- 2024/11/08 #5:
CVE-2024-50378: Apache Airflow: Secrets not masked in UI when
sensitive variables are set via Airflow cli (Ephraim Anierobi <ephraimanierobi@...che.org>)
- 2024/11/08 #4:
Re: shell wildcard expansion (un)safety (Georgi Guninski <gguninski@...il.com>)
- 2024/11/08 #3:
Re: CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777 (Solar Designer <solar@...nwall.com>)
- 2024/11/08 #2:
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
- 2024/11/08 #1:
Re: shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
- 2024/11/07 #7:
Re: shell wildcard expansion (un)safety (Mats Wichmann <mats@...hmann.us>)
- 2024/11/07 #6:
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
- 2024/11/07 #5:
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
- 2024/11/07 #4:
Re: shell wildcard expansion (un)safety (Max Nikulin <manikulin@...il.com>)
- 2024/11/07 #3:
Re: shell wildcard expansion (un)safety (Jakub Wilk <jwilk@...lk.net>)
- 2024/11/07 #2:
Re: shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
- 2024/11/07 #1:
Re: shell wildcard expansion (un)safety (Steffen Nurpmeso <steffen@...oden.eu>)
- 2024/11/06 #6:
Re: shell wildcard expansion (un)safety (Fay Stegerman <flx@...usk.net>)
- 2024/11/06 #5:
CVE-2024-51504: Apache ZooKeeper: Authentication bypass with
IP-based authentication in Admin Server (Andor Molnar <andor@...che.org>)
- 2024/11/06 #4:
Re: shell wildcard expansion (un)safety (Eli Schwartz <eschwartz@...too.org>)
- 2024/11/06 #3:
Re: shell wildcard expansion (un)safety ("David A. Wheeler" <dwheeler@...eeler.com>)
- 2024/11/06 #2:
[SECURITY ADVISTORY] curl: CVE-2024-9681 HSTS subdomain overwrites
parent cache entry (Daniel Stenberg <daniel@...x.se>)
- 2024/11/06 #1:
shell wildcard expansion (un)safety (Solar Designer <solar@...nwall.com>)
- 2024/11/03 #1:
CVE-2024-23590: Apache Kylin: Session fixation in web interface (Li Yang <liyang@...che.org>)
- 2024/11/01 #3:
Re: mpg123 buffer overflow in versions before 1.32.8
(Frankenstein's Monster) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
- 2024/11/01 #2:
Re: mpg123 buffer overflow in versions before 1.32.8
(Frankenstein's Monster) ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
- 2024/11/01 #1:
Re: mpg123 buffer overflow in versions before 1.32.8
(Frankenstein's Monster) (Alexander Patrakov <patrakov@...il.com>)
- 2024/10/31 #4:
Re: mpg123 buffer overflow in versions before 1.32.8
(Frankenstein's Monster) (Marco Benatto <mbenatto@...hat.com>)
- 2024/10/31 #3:
Re: qBittorrent RCE, Browser Hijacking vulnerabilities (Eli Schwartz <eschwartz@...too.org>)
30666 messages
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.