diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index e888468f380..d05e597df78 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,224 @@ + + MySQL -- Multiple vulnerabilities + + + mysql80-client + 8.0.38 + + + mysql80-server + 8.0.38 + + + mysql81-client + 8.1.1 + + + mysql80-server + 8.1.1 + + + mysql84-client + 8.4.1 + + + mysql84-server + 8.4.1 + + + + +

Oracle reports:

+
+

36 new security patches for Oracle MySQL. 11 of these vulnerabilities + may be remotely exploitable without authentication, i.e., may be + exploited over a network without requiring user credentials. + The highest CVSS v3.1 Base Score of vulnerabilities affecting Oracle + MySQL is 9.8.

+
+ + + + https://www.oracle.com/security-alerts/cpujul2024.html#MySQL + + + 2024-07-16 + 2024-07-16 + + + + + electron30 -- multiple vulnerabilities + + + electron30 + 30.2.0 + + + + +

Electron developers report:

+
+

This update fixes the following vulnerabilities:

+
    +
  • Security: backported fix for CVE-2024-5493.
    • +
  • Security: backported fix for CVE-2024-5831.
    • +
  • Security: backported fix for CVE-2024-5832.
    • +
  • Security: backported fix for CVE-2024-6100.
    • +
  • Security: backported fix for CVE-2024-6101.
    • +
  • Security: backported fix for CVE-2024-6103.
    • +
  • Security: backported fix for CVE-2024-6291.
    • +
  • Security: backported fix for CVE-2024-6293.
    • +
  • Security: backported fix for CVE-2024-6290.
    • +
  • Security: backported fix for CVE-2024-6292.
    • +
+
+ + + + CVE-2024-5493 + https://github.com/advisories/GHSA-f6rr-qfxh-hcf9 + CVE-2024-5831 + https://github.com/advisories/GHSA-9pmm-wf44-xjqc + CVE-2024-5832 + https://github.com/advisories/GHSA-rw9q-cwc5-qqp5 + CVE-2024-6100 + https://github.com/advisories/GHSA-g779-vpj7-v6c4 + CVE-2024-6101 + https://github.com/advisories/GHSA-rg42-f9ww-x3w7 + CVE-2024-6103 + https://github.com/advisories/GHSA-ph5m-227m-fc5g + CVE-2024-6291 + https://github.com/advisories/GHSA-rpvg-h6p6-42qj + CVE-2024-6293 + https://github.com/advisories/GHSA-9f8f-453p-rg87 + CVE-2024-6290 + https://github.com/advisories/GHSA-r5mh-qgc2-26p2 + CVE-2024-6292 + https://github.com/advisories/GHSA-m848-8f5r-6j4g + + + 2024-07-10 + 2024-07-13 + + + + + electron29 -- multiple vulnerabilities + + + electron29 + 29.4.4 + + + + +

Electron developers report:

+
+

This update fixes the following vulnerabilities:

+
    +
  • Security: backported fix for CVE-2024-6291.
    • +
  • Security: backported fix for CVE-2024-6293.
    • +
  • Security: backported fix for CVE-2024-6290.
    • +
  • Security: backported fix for CVE-2024-6292.
    • +
+
+ + + + CVE-2024-6291 + https://github.com/advisories/GHSA-rpvg-h6p6-42qj + CVE-2024-6293 + https://github.com/advisories/GHSA-9f8f-453p-rg87 + CVE-2024-6290 + https://github.com/advisories/GHSA-r5mh-qgc2-26p2 + CVE-2024-6292 + https://github.com/advisories/GHSA-m848-8f5r-6j4g + + + 2024-07-11 + 2024-07-13 + + + + + Gitlab -- vulnerabilities + + + gitlab-ce + gitlab-ee + 17.1.017.1.2 + 17.0.017.0.4 + 11.8.016.11.6 + + + + +

Gitlab reports:

+
+

An attacker can run pipeline jobs as an arbitrary user

+

Developer user with admin_compliance_framework permission can change group URL

+

Admin push rules custom role allows creation of project level deploy token

+

Package registry vulnerable to manifest confusion

+

User with admin_group_member permission can ban group members

+

Subdomain takeover in GitLab Pages

+
+ + + + CVE-2024-6385 + CVE-2024-5257 + CVE-2024-5470 + CVE-2024-6595 + CVE-2024-2880 + CVE-2024-5528 + https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released/ + + + 2024-07-10 + 2024-07-11 + + + + + Django -- multiple vulnerabilities + + + py39-django42 + py310-django42 + py311-django42 + 4.2.14 + + + py310-django50 + py311-django50 + 5.0.7 + + + + +

Django reports:

+
+

CVE-2024-38875: Potential denial-of-service in django.utils.html.urlize().

+

CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords.

+

CVE-2024-39330: Potential directory-traversal in django.core.files.storage.Storage.save().

+

CVE-2024-39614: Potential denial-of-service in django.utils.translation.get_supported_language_variant().

+
+ + + + CVE-2024-38875 + CVE-2024-39329 + CVE-2024-39330 + CVE-2024-39614 + https://www.djangoproject.com/weblog/2024/jul/09/security-releases/ + + + 2024-07-01 + 2024-07-10 + + + traefik -- Bypassing IP allow-lists via HTTP/3 early data requests