ISHACK AI BOT

Red Hat: CVE-2023-45733: intel-microcode: Race conditions in some Intel(R) Processors (Multiple Advisories) Severity 1 CVSS (AV:L/AC:H/Au:S/C:P/I:N/A:N) Published 05/16/2024 Created 11/14/2024 Added 11/13/2024 Modified 11/13/2024 Description Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access. Solution(s) redhat-upgrade-microcode_ctl References CVE-2023-45733 RHSA-2024:9401

Red Hat: CVE-2023-46103: intel-microcode: Unexpected behavior in Intel(R) Core(TM) Ultra Processors (Multiple Advisories) Severity 4 CVSS (AV:L/AC:H/Au:S/C:N/I:N/A:C) Published 05/16/2024 Created 11/14/2024 Added 11/13/2024 Modified 11/13/2024 Description Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to potentially enable denial of service via local access. Solution(s) redhat-upgrade-microcode_ctl References CVE-2023-46103 RHSA-2024:9401

Impact of TunnelVision Vulnerability Severity 7 CVSS (AV:A/AC:L/Au:N/C:C/I:P/A:P) Published 05/16/2024 Created 01/08/2025 Added 01/07/2025 Modified 01/10/2025 Description Deprecated Solution(s)

JetBrains TeamCity: CVE-2024-35302: Stored XSS during restore from backup was possible (TW-82309) Severity 6 CVSS (AV:N/AC:L/Au:N/C:P/I:P/A:N) Published 05/16/2024 Created 10/22/2024 Added 10/15/2024 Modified 02/03/2025 Description In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible Solution(s) jetbrains-teamcity-upgrade-latest References https://attackerkb.com/topics/cve-2024-35302 CVE - 2024-35302 https://www.jetbrains.com/privacy-security/issues-fixed/

Red Hat: CVE-2024-35176: REXML: DoS parsing an XML with many `<`s in an attribute value (Multiple Advisories) Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:P) Published 05/16/2024 Created 07/16/2024 Added 07/16/2024 Modified 09/13/2024 Description REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs. Solution(s) redhat-upgrade-pcs redhat-upgrade-pcs-snmp redhat-upgrade-ruby redhat-upgrade-ruby-debuginfo redhat-upgrade-ruby-debugsource redhat-upgrade-ruby-devel redhat-upgrade-ruby-doc redhat-upgrade-ruby-irb redhat-upgrade-ruby-libs redhat-upgrade-ruby-libs-debuginfo redhat-upgrade-rubygem-abrt redhat-upgrade-rubygem-abrt-doc redhat-upgrade-rubygem-bigdecimal redhat-upgrade-rubygem-bigdecimal-debuginfo redhat-upgrade-rubygem-bson redhat-upgrade-rubygem-bson-debuginfo redhat-upgrade-rubygem-bson-debugsource redhat-upgrade-rubygem-bson-doc redhat-upgrade-rubygem-bundler redhat-upgrade-rubygem-bundler-doc redhat-upgrade-rubygem-did_you_mean redhat-upgrade-rubygem-io-console redhat-upgrade-rubygem-io-console-debuginfo redhat-upgrade-rubygem-json redhat-upgrade-rubygem-json-debuginfo redhat-upgrade-rubygem-minitest redhat-upgrade-rubygem-mongo redhat-upgrade-rubygem-mongo-doc redhat-upgrade-rubygem-mysql2 redhat-upgrade-rubygem-mysql2-debuginfo redhat-upgrade-rubygem-mysql2-debugsource redhat-upgrade-rubygem-mysql2-doc redhat-upgrade-rubygem-net-telnet redhat-upgrade-rubygem-openssl redhat-upgrade-rubygem-openssl-debuginfo redhat-upgrade-rubygem-pg redhat-upgrade-rubygem-pg-debuginfo redhat-upgrade-rubygem-pg-debugsource redhat-upgrade-rubygem-pg-doc redhat-upgrade-rubygem-power_assert redhat-upgrade-rubygem-psych redhat-upgrade-rubygem-psych-debuginfo redhat-upgrade-rubygem-rake redhat-upgrade-rubygem-rdoc redhat-upgrade-rubygem-test-unit redhat-upgrade-rubygem-xmlrpc redhat-upgrade-rubygems redhat-upgrade-rubygems-devel References CVE-2024-35176 RHSA-2024:4499 RHSA-2024:5338

Huawei EulerOS: CVE-2024-35176: ruby security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 10/10/2024 Added 10/09/2024 Modified 10/09/2024 Description REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs. Solution(s) huawei-euleros-2_0_sp11-upgrade-ruby huawei-euleros-2_0_sp11-upgrade-ruby-help huawei-euleros-2_0_sp11-upgrade-ruby-irb References https://attackerkb.com/topics/cve-2024-35176 CVE - 2024-35176 EulerOS-SA-2024-2594

Alpine Linux: CVE-2024-4603: Vulnerability in Multiple Components Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 06/11/2024 Added 06/06/2024 Modified 10/01/2024 Description Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. Solution(s) alpine-linux-upgrade-openssl References https://attackerkb.com/topics/cve-2024-4603 CVE - 2024-4603 https://security.alpinelinux.org/vuln/CVE-2024-4603

Debian: CVE-2023-46103: intel-microcode -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 07/31/2024 Added 07/30/2024 Modified 07/30/2024 Description Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to potentially enable denial of service via local access. Solution(s) debian-upgrade-intel-microcode References https://attackerkb.com/topics/cve-2023-46103 CVE - 2023-46103

Alma Linux: CVE-2024-21823: Important: kernel security update (Multiple Advisories) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 08/13/2024 Added 08/12/2024 Modified 11/04/2024 Description Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access Solution(s) alma-upgrade-bpftool alma-upgrade-kernel alma-upgrade-kernel-64k alma-upgrade-kernel-64k-core alma-upgrade-kernel-64k-debug alma-upgrade-kernel-64k-debug-core alma-upgrade-kernel-64k-debug-devel alma-upgrade-kernel-64k-debug-devel-matched alma-upgrade-kernel-64k-debug-modules alma-upgrade-kernel-64k-debug-modules-core alma-upgrade-kernel-64k-debug-modules-extra alma-upgrade-kernel-64k-devel alma-upgrade-kernel-64k-devel-matched alma-upgrade-kernel-64k-modules alma-upgrade-kernel-64k-modules-core alma-upgrade-kernel-64k-modules-extra alma-upgrade-kernel-abi-stablelists alma-upgrade-kernel-core alma-upgrade-kernel-cross-headers alma-upgrade-kernel-debug alma-upgrade-kernel-debug-core alma-upgrade-kernel-debug-devel alma-upgrade-kernel-debug-devel-matched alma-upgrade-kernel-debug-modules alma-upgrade-kernel-debug-modules-core alma-upgrade-kernel-debug-modules-extra alma-upgrade-kernel-debug-uki-virt alma-upgrade-kernel-devel alma-upgrade-kernel-devel-matched alma-upgrade-kernel-doc alma-upgrade-kernel-headers alma-upgrade-kernel-modules alma-upgrade-kernel-modules-core alma-upgrade-kernel-modules-extra alma-upgrade-kernel-rt alma-upgrade-kernel-rt-core alma-upgrade-kernel-rt-debug alma-upgrade-kernel-rt-debug-core alma-upgrade-kernel-rt-debug-devel alma-upgrade-kernel-rt-debug-kvm alma-upgrade-kernel-rt-debug-modules alma-upgrade-kernel-rt-debug-modules-core alma-upgrade-kernel-rt-debug-modules-extra alma-upgrade-kernel-rt-devel alma-upgrade-kernel-rt-kvm alma-upgrade-kernel-rt-modules alma-upgrade-kernel-rt-modules-core alma-upgrade-kernel-rt-modules-extra alma-upgrade-kernel-tools alma-upgrade-kernel-tools-libs alma-upgrade-kernel-tools-libs-devel alma-upgrade-kernel-uki-virt alma-upgrade-kernel-zfcpdump alma-upgrade-kernel-zfcpdump-core alma-upgrade-kernel-zfcpdump-devel alma-upgrade-kernel-zfcpdump-devel-matched alma-upgrade-kernel-zfcpdump-modules alma-upgrade-kernel-zfcpdump-modules-core alma-upgrade-kernel-zfcpdump-modules-extra alma-upgrade-libperf alma-upgrade-perf alma-upgrade-python3-perf alma-upgrade-rtla alma-upgrade-rv References https://attackerkb.com/topics/cve-2024-21823 CVE - 2024-21823 https://errata.almalinux.org/8/ALSA-2024-5101.html https://errata.almalinux.org/8/ALSA-2024-5102.html https://errata.almalinux.org/9/ALSA-2024-5363.html

Ubuntu: USN-6797-1 (CVE-2023-47855): Intel Microcode vulnerabilities Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 06/07/2024 Added 06/06/2024 Modified 11/15/2024 Description Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access. Solution(s) ubuntu-pro-upgrade-intel-microcode References https://attackerkb.com/topics/cve-2023-47855 CVE - 2023-47855 USN-6797-1

Alma Linux: CVE-2023-46103: Moderate: microcode_ctl security update (ALSA-2024-9401) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 11/21/2024 Added 11/19/2024 Modified 11/19/2024 Description Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to potentially enable denial of service via local access. Solution(s) alma-upgrade-microcode_ctl References https://attackerkb.com/topics/cve-2023-46103 CVE - 2023-46103 https://errata.almalinux.org/9/ALSA-2024-9401.html

Google Chrome Vulnerability: CVE-2024-4948 Use after free in Dawn Severity 7 CVSS (AV:N/AC:M/Au:N/C:N/I:N/A:C) Published 05/16/2024 Created 05/16/2024 Added 05/16/2024 Modified 01/28/2025 Description Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Solution(s) google-chrome-upgrade-latest References https://attackerkb.com/topics/cve-2024-4948 CVE - 2024-4948

Debian: CVE-2023-46842: xen -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 12/31/2024 Added 12/30/2024 Modified 12/30/2024 Description Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes.This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation.Doing so involves putting (perhaps updated) hypercall arguments in respective registers.For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall.When this is found not to be the case, it triggers a consistency check in the hypervisor and causes a crash. Solution(s) debian-upgrade-xen References https://attackerkb.com/topics/cve-2023-46842 CVE - 2023-46842 DSA-5836-1

Debian: CVE-2023-45733: intel-microcode -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 07/31/2024 Added 07/30/2024 Modified 07/30/2024 Description Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access. Solution(s) debian-upgrade-intel-microcode References https://attackerkb.com/topics/cve-2023-45733 CVE - 2023-45733

Alpine Linux: CVE-2024-31142: Vulnerability in Multiple Components Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 06/11/2024 Added 06/06/2024 Modified 10/01/2024 Description Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-434 (Speculative Return Stack Overflow) uses the same infrastructure, so is equally impacted. For more details, see: https://xenbits.xen.org/xsa/advisory-407.html https://xenbits.xen.org/xsa/advisory-434.html Solution(s) alpine-linux-upgrade-xen References https://attackerkb.com/topics/cve-2024-31142 CVE - 2024-31142 https://security.alpinelinux.org/vuln/CVE-2024-31142

Debian: CVE-2023-45745: intel-microcode -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 07/31/2024 Added 07/30/2024 Modified 07/30/2024 Description Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access. Solution(s) debian-upgrade-intel-microcode References https://attackerkb.com/topics/cve-2023-45745 CVE - 2023-45745

Amazon Linux 2023: CVE-2024-33869: Medium priority package update for ghostscript Severity 5 CVSS (AV:L/AC:L/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur (via a crafted PostScript document) because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command# output filename. A flaw was found in Ghostscript. In certain circumstances, path reduction in the &quot;gp_validate_path_len&quot; function may allow path traversal or possible command execution. Solution(s) amazon-linux-2023-upgrade-ghostscript amazon-linux-2023-upgrade-ghostscript-debuginfo amazon-linux-2023-upgrade-ghostscript-debugsource amazon-linux-2023-upgrade-ghostscript-doc amazon-linux-2023-upgrade-ghostscript-gtk amazon-linux-2023-upgrade-ghostscript-gtk-debuginfo amazon-linux-2023-upgrade-ghostscript-tools-dvipdf amazon-linux-2023-upgrade-ghostscript-tools-fonts amazon-linux-2023-upgrade-ghostscript-tools-printing amazon-linux-2023-upgrade-ghostscript-x11 amazon-linux-2023-upgrade-ghostscript-x11-debuginfo amazon-linux-2023-upgrade-libgs amazon-linux-2023-upgrade-libgs-debuginfo amazon-linux-2023-upgrade-libgs-devel References https://attackerkb.com/topics/cve-2024-33869 CVE - 2024-33869 https://alas.aws.amazon.com/AL2023/ALAS-2024-691.html

Amazon Linux 2023: CVE-2024-4603: Medium priority package update for openssl Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:P) Published 05/16/2024 Created 02/14/2025 Added 02/14/2025 Modified 02/14/2025 Description Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. A flaw was found in OpenSSL. Applications that use the EVP_PKEY_param_check() or EVP_PKEY_public_check() function to check a DSA public key or DSA parameters may experience long delays when checking excessively long DSA keys or parameters. In applications that allow untrusted sources to provide the key or parameters that are checked, an attacker may be able to cause a denial of service. These functions are not called by OpenSSL on untrusted DSA keys. The applications that directly call these functions are the ones that may be vulnerable to this issue. Solution(s) amazon-linux-2023-upgrade-openssl amazon-linux-2023-upgrade-openssl-debuginfo amazon-linux-2023-upgrade-openssl-debugsource amazon-linux-2023-upgrade-openssl-devel amazon-linux-2023-upgrade-openssl-libs amazon-linux-2023-upgrade-openssl-libs-debuginfo amazon-linux-2023-upgrade-openssl-perl amazon-linux-2023-upgrade-openssl-snapsafe-libs amazon-linux-2023-upgrade-openssl-snapsafe-libs-debuginfo References https://attackerkb.com/topics/cve-2024-4603 CVE - 2024-4603 https://alas.aws.amazon.com/AL2023/ALAS-2024-677.html

Red Hat: CVE-2024-4603: openssl: Excessive time spent checking DSA keys and parameters (Multiple Advisories) Severity 5 CVSS (AV:N/AC:L/Au:N/C:N/I:N/A:P) Published 05/16/2024 Created 11/14/2024 Added 11/13/2024 Modified 11/13/2024 Description Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param_check() or EVP_PKEY_public_check() to check a DSA public key or DSA parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The functions EVP_PKEY_param_check() or EVP_PKEY_public_check() perform various checks on DSA parameters. Some of those computations take a long time if the modulus (`p` parameter) is too large. Trying to use a very large modulus is slow and OpenSSL will not allow using public keys with a modulus which is over 10,000 bits in length for signature verification. However the key and parameter check functions do not limit the modulus size when performing the checks. An application that calls EVP_PKEY_param_check() or EVP_PKEY_public_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. These functions are not called by OpenSSL itself on untrusted DSA keys so only applications that directly call these functions may be vulnerable. Also vulnerable are the OpenSSL pkey and pkeyparam command line applications when using the `-check` option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are affected by this issue. Solution(s) redhat-upgrade-openssl redhat-upgrade-openssl-debuginfo redhat-upgrade-openssl-debugsource redhat-upgrade-openssl-devel redhat-upgrade-openssl-fips-provider redhat-upgrade-openssl-fips-provider-so redhat-upgrade-openssl-fips-provider-so-debuginfo redhat-upgrade-openssl-fips-provider-so-debugsource redhat-upgrade-openssl-libs redhat-upgrade-openssl-libs-debuginfo redhat-upgrade-openssl-perl References CVE-2024-4603 RHSA-2024:9333

Alma Linux: CVE-2023-45733: Moderate: microcode_ctl security update (ALSA-2024-9401) Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 11/21/2024 Added 11/19/2024 Modified 11/19/2024 Description Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access. Solution(s) alma-upgrade-microcode_ctl References https://attackerkb.com/topics/cve-2023-45733 CVE - 2023-45733 https://errata.almalinux.org/9/ALSA-2024-9401.html

Google Chrome Vulnerability: CVE-2024-4950 Inappropriate implementation in Downloads Severity 7 CVSS (AV:N/AC:M/Au:N/C:C/I:N/A:N) Published 05/16/2024 Created 05/16/2024 Added 05/16/2024 Modified 01/28/2025 Description Inappropriate implementation in Downloads in Google Chrome prior to 125.0.6422.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) Solution(s) google-chrome-upgrade-latest References https://attackerkb.com/topics/cve-2024-4950 CVE - 2024-4950

Google Chrome Vulnerability: CVE-2024-4947 Type Confusion in V8 Severity 9 CVSS (AV:N/AC:M/Au:N/C:C/I:C/A:C) Published 05/16/2024 Created 05/16/2024 Added 05/16/2024 Modified 01/28/2025 Description Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Solution(s) google-chrome-upgrade-latest References https://attackerkb.com/topics/cve-2024-4947 CVE - 2024-4947 https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_15.html

Debian: CVE-2023-47855: intel-microcode -- security update Severity 4 CVSS (AV:L/AC:M/Au:N/C:P/I:P/A:P) Published 05/16/2024 Created 07/31/2024 Added 07/30/2024 Modified 07/30/2024 Description Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable escalation of privilege via local access. Solution(s) debian-upgrade-intel-microcode References https://attackerkb.com/topics/cve-2023-47855 CVE - 2023-47855

Alpine Linux: CVE-2023-45733: Vulnerability in Multiple Components Severity 2 CVSS (AV:L/AC:M/Au:S/C:P/I:N/A:N) Published 05/16/2024 Created 06/11/2024 Added 06/06/2024 Modified 10/02/2024 Description Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial information disclosure via local access. Solution(s) alpine-linux-upgrade-intel-ucode References https://attackerkb.com/topics/cve-2023-45733 CVE - 2023-45733 https://security.alpinelinux.org/vuln/CVE-2023-45733

JetBrains TeamCity: CVE-2024-35300: Several Stored XSS in the available updates page were possible (TW-87050) Severity 5 CVSS (AV:N/AC:L/Au:M/C:P/I:P/A:N) Published 05/16/2024 Created 10/22/2024 Added 10/15/2024 Modified 02/03/2025 Description In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible Solution(s) jetbrains-teamcity-upgrade-latest References https://attackerkb.com/topics/cve-2024-35300 CVE - 2024-35300 https://www.jetbrains.com/privacy-security/issues-fixed/