🟠 High ⏱ 5–30 min Last verified: 13 December 2024 Affected versions: Debian 12 📖 ~1 min read Table of contents Symptom & Impact Environment & Reproduction Root Cause Analysis Quick Triage Step-by-Step Diagnosis Solution – Primary Fix Solution – Alternative Approaches Verification & Acceptance Criteria Rollback Plan Prevention & Hardening Related Errors & […]
🟠 High ⏱ 15–60 min Last verified: 13 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2014-9494 CVE-2014-9649 CVE-2014-9650 CVE-2015-0862 CVE-2015-8786 CVE-2016-9877 CVE-2017-4965 CVE-2017-4966 +11 more Upstream summary: RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header. […]
🟢 Low ⏱ 5–15 min Last verified: 13 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2008-4971 Upstream summary: mafft-homologs in mafft 6.240 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/_vf#?????, (2) /tmp/_if#?????, (3) /tmp/_pf#?????, (4) /tmp/_af#?????, (5) […]
🟡 Medium ⏱ 10–30 min Last verified: 12 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2014-0240 CVE-2014-0242 CVE-2014-8583 CVE-2022-2255 Upstream summary: The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when […]
🟢 Low ⏱ 5–15 min Last verified: 12 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2022-1341 Upstream summary: An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c. Table of contents Symptom & Impact Environment […]
🟡 Medium ⏱ 10–30 min Last verified: 12 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2018-25045 CVE-2020-25626 CVE-2024-21520 Upstream summary: Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping. Table of contents Symptom […]
🟡 Medium ⏱ 10–30 min Last verified: 11 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2010-2246 CVE-2011-0702 CVE-2011-1031 CVE-2017-7875 Upstream summary: feh before 1.8, when the –wget-timestamp option is enabled, might allow remote attackers to execute arbitrary commands via shell metacharacters in a […]
🟢 Low ⏱ 5–15 min Last verified: 11 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2011-2729 Upstream summary: native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and […]
🟢 Low ⏱ 5–15 min Last verified: 11 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2021-32850 Upstream summary: jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. […]
🟠 High ⏱ 15–60 min Last verified: 11 December 2024 Affected versions: Debian 12 (bookworm) 📖 ~4 min read • Source: Debian Security Tracker Related CVEs: CVE-2007-1558 CVE-2007-6208 CVE-2010-5109 CVE-2012-4507 CVE-2014-2576 CVE-2015-8614 CVE-2015-8708 CVE-2019-10735 +3 more Upstream summary: The APOP protocol allows remote attackers to guess the first 3 characters of a password via […]
