Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- GPU drivers;
- HID subsystem;
- Media drivers;
- JFS file system;
- Network namespace;
- Networking core;
- Netlink;
(CVE-2024-57798, CVE-2024-53140, CVE-2024-56595, CVE-2024-56598,
CVE-2024-50302, CVE-2024-56658, CVE-2024-56672, CVE-2024-53063)
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- IPv4 networking;
(CVE-2024-26882)
GROWI, a product by GROWI, Inc., has been reported to contain multiple vulnerabilities. No specific details about the nature, impact, or affected versions of these vulnerabilities have been provided.
CVE-2024-11831 is a cross-site scripting (XSS) vulnerability in the serialize-javascript npm package version 6.0. The flaw arises because the module does not properly sanitize certain inputs such as regex or other JavaScript object types, allowing malicious code injection. This vulnerability is critical in scenarios where serialized data is sent to web clients and deserialized by browsers, potentially compromising web application security.
CVE-2026-113715 is a low-severity vulnerability in virtualenv's venv creator configuration readback. It arises because virtualenv reads the standard library's pyvenv.cfg file using splitlines(), which treats certain Unicode line boundary characters (e.g., U+2028) as line breaks. An attacker-controlled destination path containing such characters can inject additional configuration keys into virtualenv's settings, altering environment behavior such as the 'home' directory and site-packages inclusion. This can weaken environment isolation and change which standard library files the interpreter loads. The issue affects virtualenv versions from 3.27.0 up to but not including 4.67.0. A fix is available in version 4.67.0 that rejects line-boundary characters before creation and rebuilds the configuration safely.
A vulnerability in Psono Server CE and EE versions 4.0.33 through 7.2.3 allows an authenticated attacker with a write-enabled but read-disabled API key to access encrypted secret data via the bulk-secret-read endpoint when URL_PREFIX is configured. This occurs due to incorrect authorization logic that compares request paths without considering the URL prefix, causing the endpoint to authorize requests with write scope instead of read scope. The default configuration without URL_PREFIX is not affected. The issue is fixed in version 7.2.4.
The Payex Payment Gateway for Woocommerce WordPress plugin versions up to 1.2.10 contains an authentication flaw. It does not properly verify the authenticity of incoming payment notifications because it relies on a validation secret that is empty by default. This allows unauthenticated attackers to forge payment confirmations and mark any order as paid.
The Payment Integration Wompi WordPress plugin versions up to 4.0.1 does not verify the authenticity of incoming payment notifications by default. This is due to the callback checksum relying on a merchant secret that is empty until manually configured. As a result, an unauthenticated attacker can forge payment notifications and mark arbitrary orders as paid.
Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could claim an attacker-controlled device code and obtain a full read-write session valid for up to 365 days, bypassing the original token's scope and lifetime restrictions. This did not bypass two-factor authentication or directly disclose plaintext secrets.