logo
DATABASE RESOURCES PRICING ABOUT US

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.5)

2022-11-09T00:00:00

Description

The version of AOS installed on the remote host is prior to 5.20.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.20.5 advisory. - zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. (CVE-2018-25032) - In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel (CVE-2020-0465) - In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel (CVE-2020-0466) - A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP's slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability. (CVE-2020-25709) - A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability. (CVE-2020-25710) - http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request. (CVE-2020-26116) - urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. (CVE-2020-26137) - In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel (CVE-2021-0920) - An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion. (CVE-2021-21996) - Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely. (CVE-2021-3177) - A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI TTY Bluetooth device. A local user could use this flaw to crash the system. This flaw affects all the Linux kernel versions starting from 3.13. (CVE-2021-3564) - A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add(), hci_sock_blacklist_del(), hci_get_conn_info(), hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5. (CVE-2021-3573) - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3752) - A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. (CVE-2021-4155) - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). (CVE-2021-45960) - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. (CVE-2021-46143) - A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. (CVE-2022-0330) - A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. (CVE-2022-0492) - The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self- signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc). (CVE-2022-0778) - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system. (CVE-2022-1271) - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. (CVE-2022-1729) - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21123) - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125) - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21426) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21434) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21443) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21449) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21476) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21496) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21540) - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 7u343, 8u333, 11.0.15.1, 17.0.3.1, 18.0.1.1; Oracle GraalVM Enterprise Edition: 20.3.6, 21.3.2 and 22.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. (CVE-2022-21541) - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling (CVE-2022-22720) - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822) - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823) - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22824) - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825) - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22826) - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827) - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852) - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. (CVE-2022-24407) - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235) - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. (CVE-2022-25236) - A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later. (CVE-2022-2526) - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. (CVE-2022-25315) - If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors. (CVE-2022-25762) - An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A malicious rsync server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rsync client target directory and subdirectories (for example, overwrite the .ssh/authorized_keys file). (CVE-2022-29154) - The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks. (CVE-2022-29885) - VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine. (CVE-2022-31676) - The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. The Apache Xalan Java project is dormant and in the process of being retired. No future releases of Apache Xalan Java to address this issue are expected. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan. (CVE-2022-34169) - In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. (CVE-2022-34305) - kernel: failing usercopy allows for use-after-free exploitation (CVE-2022-22942) Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.


Related


nessus
scanner

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.6)

2023-01-24T00:00:00
nessus
scanner

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.3.6)

2022-09-21T00:00:00
nessus
scanner

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.2286)

2022-09-01T00:00:00
nessus
scanner

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.30398)

2022-09-27T00:00:00
nessus
scanner

Nutanix AOS : (NXSA-AOS-6.5.1.5)

2022-09-07T00:00:00
nessus
scanner

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.242)

2023-01-25T00:00:00
nessus
scanner

Oracle Linux 7 : expat (ELSA-2022-1069)

2022-03-29T00:00:00
nessus
scanner

Oracle Linux 8 : expat (ELSA-2022-0951)

2022-03-16T00:00:00
nessus
scanner

NewStart CGSL CORE 5.04 / MAIN 5.04 : expat Multiple Vulnerabilities (NS-SA-2022-0082)

2022-11-15T00:00:00
nessus
scanner

NewStart CGSL MAIN 6.02 : expat Multiple Vulnerabilities (NS-SA-2022-0098)

2022-11-15T00:00:00
nessus
scanner

CentOS 7 : expat (CESA-2022:1069)

2022-03-30T00:00:00
nessus
scanner

RHEL 8 : expat (RHSA-2022:0951)

2022-03-17T00:00:00
nessus
scanner

RHEL 7 : expat (RHSA-2022:1069)

2022-03-29T00:00:00
nessus
scanner

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.1.1.5)

2022-09-01T00:00:00
nessus
scanner

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.20.4.5)

2022-09-01T00:00:00
nessus
scanner

EulerOS 2.0 SP3 : expat (EulerOS-SA-2022-1716)

2022-05-26T00:00:00
nessus
scanner

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 21.10 : Expat vulnerabilities (USN-5288-1)

2022-02-21T00:00:00
nessus
scanner

EulerOS 2.0 SP8 : expat (EulerOS-SA-2022-1342)

2022-03-28T00:00:00
nessus
scanner

openSUSE 15 Security Update : expat (openSUSE-SU-2022:0178-1)

2022-01-26T00:00:00
nessus
scanner

SUSE SLED15 / SLES15 Security Update : expat (SUSE-SU-2022:0178-1)

2022-01-26T00:00:00
nessus
scanner

Slackware Linux 14.0 / 14.1 / 14.2 / current expat Multiple Vulnerabilities (SSA:2022-016-01)

2022-01-16T00:00:00
nessus
scanner

EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1502)

2022-04-20T00:00:00
nessus
scanner

SUSE SLED12 / SLES12 Security Update : expat (SUSE-SU-2022:0179-1)

2022-01-26T00:00:00
nessus
scanner

EulerOS 2.0 SP10 : expat (EulerOS-SA-2022-1483)

2022-04-20T00:00:00
nessus
scanner

SUSE SLES11 Security Update : expat (SUSE-SU-2022:14878-1)

2022-01-26T00:00:00
nessus
scanner

RHEL 7 : kernel (RHSA-2022:0620)

2022-02-23T00:00:00
nessus
scanner

RHEL 7 : kernel-rt (RHSA-2022:0622)

2022-02-22T00:00:00
nessus
scanner

Scientific Linux Security Update : kernel on SL7.x x86_64 (2022:0620)

2022-02-24T00:00:00
nessus
scanner

CentOS 7 : kernel (CESA-2022:0620)

2022-02-25T00:00:00
nessus
scanner

Oracle Linux 7 : kernel (ELSA-2022-0620)

2022-02-23T00:00:00
nessus
scanner

EulerOS Virtualization 2.9.1 : expat (EulerOS-SA-2022-1605)

2022-05-05T00:00:00
nessus
scanner

Debian DSA-5073-1 : expat - security update

2022-02-13T00:00:00
nessus
scanner

Debian DLA-2904-1 : expat - LTS security update

2022-01-31T00:00:00
nessus
scanner

EulerOS Virtualization 2.9.0 : expat (EulerOS-SA-2022-1628)

2022-05-05T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : expat (EulerOS-SA-2022-1425)

2022-04-18T00:00:00
nessus
scanner

Tenable Nessus 10.x < 10.1.1 / 8.x < 8.15.3 Third-Party Vulnerabilities (TNS-2022-05)

2022-02-08T00:00:00
nessus
scanner

EulerOS 2.0 SP9 : expat (EulerOS-SA-2022-1446)

2022-04-18T00:00:00
nessus
scanner

EulerOS 2.0 SP3 : xulrunner (EulerOS-SA-2022-1774)

2022-05-26T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.2.0 : expat (EulerOS-SA-2022-1679)

2022-05-07T00:00:00
nessus
scanner

CentOS 8 : xmlrpc-c (CESA-2022:7692)

2022-11-08T00:00:00
nessus
scanner

Amazon Linux 2 : expat (ALAS-2022-1809)

2022-07-15T00:00:00
nessus
scanner

Oracle Linux 8 : xmlrpc-c (ELSA-2022-7692)

2022-11-15T00:00:00
nessus
scanner

AlmaLinux 8 : xmlrpc-c (ALSA-2022:7692)

2022-11-14T00:00:00
nessus
scanner

Amazon Linux AMI : expat (ALAS-2022-1603)

2022-07-08T00:00:00
nessus
scanner

RHEL 8 : xmlrpc-c (RHSA-2022:7692)

2022-11-08T00:00:00
nessus
scanner

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2022-002)

2022-09-15T00:00:00
nessus
scanner

Ubuntu 16.04 ESM : OpenJDK 8 vulnerabilities (USN-5546-2)

2022-08-05T00:00:00
nessus
scanner

EulerOS Virtualization 2.10.1 : expat (EulerOS-SA-2022-2050)

2022-07-14T00:00:00
nessus
scanner

EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2022-2022)

2022-07-15T00:00:00
nessus
scanner

EulerOS Virtualization 3.0.6.0 : expat (EulerOS-SA-2022-2555)

2022-10-10T00:00:00
nessus
scanner

Amazon Linux 2022 : expat (ALAS2022-2022-232)

2022-12-09T00:00:00
nessus
scanner

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.10013)

2023-01-25T00:00:00
nessus
scanner

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : OpenJDK vulnerabilities (USN-5546-1)

2022-08-05T00:00:00
nessus
scanner

Azul Zulu Java Multiple Vulnerabilities (2022-04-19)

2022-04-19T00:00:00
nessus
scanner

GLSA-202209-24 : Expat: Multiple Vulnerabilities

2022-09-29T00:00:00
nessus
scanner

openSUSE 15 Security Update : java-1_8_0-openj9 (SUSE-SU-2022:3092-1)

2023-01-20T00:00:00
nessus
scanner

Oracle Linux 9 : java-17-openjdk (ELSA-2022-1729)

2022-07-07T00:00:00
nessus
scanner

Oracle Java SE Multiple Vulnerabilities (April 2022 CPU) deprecated

2022-04-20T00:00:00
nessus
scanner

AlmaLinux 9 : java-17-openjdk (ALSA-2022:1729)

2022-11-16T00:00:00
nessus
scanner

OpenJDK 7 <= 7u331 / 8 <= 8u322 / 11.0.0 <= 11.0.14 / 13.0.0 <= 13.0.10 / 15.0.0 <= 15.0.6 / 17.0.0 <= 17.0.2 / 18.0.0 <= 18.0.0 Multiple Vulnerabilities (2022-04-19)

2022-04-20T00:00:00
nessus
scanner

Debian DSA-5131-1 : openjdk-11 - security update

2022-05-05T00:00:00
nessus
scanner

Debian DSA-5128-1 : openjdk-17 - security update

2022-05-05T00:00:00
nessus
scanner

Oracle Linux 8 : java-17-openjdk (ELSA-2022-1445)

2022-04-21T00:00:00
nessus
scanner

Ubuntu 20.04 LTS / 21.10 : OpenJDK vulnerabilities (USN-5388-2)

2022-04-26T00:00:00
nessus
scanner

Oracle Java SE Multiple Vulnerabilities (Unix April 2022 CPU) deprecated

2022-04-20T00:00:00
nessus
scanner

RHEL 9 : java-17-openjdk (RHSA-2022:1729)

2022-09-08T00:00:00
nessus
scanner

RHEL 8 : java-17-openjdk (RHSA-2022:1445)

2022-04-20T00:00:00
nessus
scanner

Oracle Java SE Multiple Vulnerabilities (April 2022 CPU)

2022-05-17T00:00:00
nessus
scanner

Amazon Corretto Java 18.x < 18.0.1.10.1 Multiple Vulnerabilities

2022-04-19T00:00:00
nessus
scanner

Amazon Corretto Java 17.x < 17.0.3.6.1 Multiple Vulnerabilities

2022-04-19T00:00:00
nessus
scanner

Amazon Corretto Java 8.x < 8.332.08.1 Multiple Vulnerabilities

2022-04-19T00:00:00
nessus
scanner

Amazon Linux 2 : java-17-amazon-corretto (ALAS-2022-1791)

2022-04-27T00:00:00
nessus
scanner

Oracle Linux 9 : java-11-openjdk (ELSA-2022-1728)

2022-07-07T00:00:00
nessus
scanner

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2022-002)

2022-05-02T00:00:00
nessus
scanner

AlmaLinux 9 : java-11-openjdk (ALSA-2022:1728)

2022-11-16T00:00:00
nessus
scanner

RHEL 9 : java-1.8.0-openjdk (RHSA-2022:2137)

2022-09-08T00:00:00
nessus
scanner

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2022:1440)

2022-04-21T00:00:00
nessus
scanner

Ubuntu 20.04 LTS / 21.10 : OpenJDK vulnerabilities (USN-5388-1)

2022-04-26T00:00:00
nessus
scanner

Debian DLA-3006-1 : openjdk-8 - LTS security update

2022-05-14T00:00:00
nessus
scanner

RHEL 8 : java-11-openjdk (RHSA-2022:1442)

2022-04-21T00:00:00
nessus
scanner

RHEL 8 : java-1.8.0-openjdk (RHSA-2022:1490)

2022-04-25T00:00:00
nessus
scanner

RHEL 8 : java-1.8.0-openjdk (RHSA-2022:1488)

2022-04-26T00:00:00
nessus
scanner

Oracle Linux 9 : java-1.8.0-openjdk (ELSA-2022-2137)

2022-07-07T00:00:00
nessus
scanner

RHEL 8 : java-11-openjdk (RHSA-2022:1444)

2022-04-21T00:00:00
nessus
scanner

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2022-1778)

2022-04-27T00:00:00
nessus
scanner

Amazon Linux 2 : java-11-amazon-corretto (ALAS-2022-1790)

2022-04-27T00:00:00
nessus
scanner

RHEL 8 : java-1.8.0-openjdk (RHSA-2022:1489)

2022-04-25T00:00:00
nessus
scanner

AlmaLinux 9 : java-1.8.0-openjdk (ALSA-2022:2137)

2022-11-16T00:00:00
nessus
scanner

SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2022:1474-1)

2022-04-30T00:00:00
nessus
scanner

RHEL 8 : java-1.8.0-openjdk (RHSA-2022:1491)

2022-04-26T00:00:00
nessus
scanner

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : java-11-openjdk (SUSE-SU-2022:1513-1)

2022-05-04T00:00:00
nessus
scanner

RHEL 7 : java-1.8.0-openjdk (RHSA-2022:1487)

2022-04-27T00:00:00
nessus
scanner

Oracle Linux 8 : java-1.8.0-openjdk (ELSA-2022-1491)

2022-04-25T00:00:00
nessus
scanner

RHEL 8 : java-11-openjdk (RHSA-2022:1441)

2022-04-21T00:00:00
nessus
scanner

CentOS 7 : java-11-openjdk (CESA-2022:1440)

2022-05-13T00:00:00
nessus
scanner

RHEL 7 : java-11-openjdk (RHSA-2022:1440)

2022-04-20T00:00:00
nessus
scanner

RHEL 8 : java-11-openjdk (RHSA-2022:1443)

2022-04-20T00:00:00
nessus
scanner

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALAS-2022-002) (deprecated)

2022-04-28T00:00:00
nessus
scanner

SUSE SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2022:2531-1)

2022-07-23T00:00:00
nessus
scanner

Oracle Linux 8 : java-11-openjdk (ELSA-2022-1442)

2022-04-21T00:00:00
nessus
scanner

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2022-1487)

2022-04-25T00:00:00
nessus
scanner

Oracle Linux 7 : java-11-openjdk (ELSA-2022-1440)

2022-04-21T00:00:00
almalinux
unix

Important: expat security update

2022-03-16T00:00:00
almalinux
unix

Moderate: xmlrpc-c security update

2022-11-08T00:00:00
almalinux
unix

Important: java-17-openjdk security and bug fix update

2022-04-20T12:21:21
almalinux
unix

Important: java-1.8.0-openjdk security update

2022-04-25T15:17:09
almalinux
unix

Important: java-11-openjdk security update

2022-04-20T12:24:01
ibm
software

Security Bulletin: IBM QRadar Network Security is affected by multiple vulnerabilities in Expact library.

2022-07-19T08:54:07
ibm
software

Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities

2022-11-09T18:38:30
ibm
software

Security Bulletin: IBM QRadar Network Packet Capture includes multiple vulnerable components.

2022-07-05T13:50:24
ibm
software

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

2022-10-24T20:09:51
ibm
software

Security Bulletin: Multiple vulnerabilities have been identified in IBM HTTP Server used by IBM Rational ClearQuest

2022-04-07T03:54:04
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server affect IBM Business Automation Workflow and IBM Business Process Manager

2022-09-14T15:28:14
ibm
software

Security Bulletin: Multiple Vulnerabilities have been identified in IBM HTTP Server shipped with WebSphere Remote Server

2022-03-04T19:18:28
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by IBM WebSphere Application Server due to Expat vulnerabilities

2022-03-02T18:47:38
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server shipped in IBM WebSphere Application Server Patterns

2022-04-22T21:39:22
ibm
software

Security Bulletin: Due to use of Expat IBM Tivoli Network Manager is vulnerable to arbitrary code execution (multiple vulnerabilities)

2022-07-04T12:59:59
ibm
software

Security Bulletin: Expat vulnerabilities affect IBM Netezza Analytics

2022-06-03T14:32:29
ibm
software

Security Bulletin: Expat vulnerabilities affect IBM Netezza Analytics for NPS

2022-06-03T14:32:29
ibm
software

Security Bulletin: IBM Tivoli Monitoring is vulnerable to remote code execution and denial of service due to multiple Expat CVEs

2022-12-30T17:31:59
ibm
software

Security Bulletin: AIX is affected by multiple vulnerabilities in Python

2022-07-28T20:09:50
ibm
software

Security Bulletin: Multiple Vulnerabilities in Expat component shipped with IBM Rational ClearCase ( CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827 )

2022-07-25T14:51:53
ibm
software

Security Bulletin: Multiple security vulnerabilities have been identified in IBM HTTP Server shipped with IBM Rational ClearCase

2022-04-01T06:18:19
ibm
software

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server affect IBM Netezza Performance Portal

2022-03-16T11:34:12
ibm
software

Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

2022-10-06T08:10:57
ibm
software

Security Bulletin: Multiple vulnerabilities may affect IBM® Semeru Runtime

2022-05-25T09:44:34
ibm
software

Security Bulletin: Multiple Java DOS vulnerabilities detected

2022-09-28T21:24:11
ibm
software

Security Bulletin: Multiple vulnerabilities affect IBM Tivoli Monitoring included WebSphere Application Server and IBM HTTP Server used by WebSphere Application Server

2022-12-30T17:31:59
ibm
software

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from expat, Golang Go, gcc, openssl and libxml.

2022-05-16T06:59:14
redhat
unix

(RHSA-2022:0951) Important: expat security update

2022-03-16T15:13:06
redhat
unix

(RHSA-2022:1069) Important: expat security update

2022-03-28T08:42:24
redhat
unix

(RHSA-2022:0622) Important: kernel-rt security and bug fix update

2022-02-22T14:27:10
redhat
unix

(RHSA-2022:0620) Important: kernel security and bug fix update

2022-02-22T14:25:44
redhat
unix

(RHSA-2022:7692) Moderate: xmlrpc-c security update

2022-11-08T06:26:32
redhat
unix

(RHSA-2022:6252) Moderate: OpenShift Container Platform 3.11.784 security update

2022-09-07T14:11:28
redhat
unix

(RHSA-2022:1747) Low: Release of OpenShift Serverless Version 1.22.0

2022-05-09T12:15:21
redhat
unix

(RHSA-2022:1729) Important: java-17-openjdk security update

2022-05-17T22:32:49
redhat
unix

(RHSA-2022:1436) Important: OpenJDK 17.0.3 security update for Portable Linux Builds

2022-04-28T19:02:41
redhat
unix

(RHSA-2022:1445) Important: java-17-openjdk security and bug fix update

2022-04-20T12:21:21
redhat
unix

(RHSA-2022:1437) Important: OpenJDK 17.0.3 security update for Windows Builds

2022-04-28T19:02:34
redhat
unix

(RHSA-2022:2272) Moderate: OpenShift Container Platform 4.8.41 bug fix and security update

2022-05-25T21:38:41
redhat
unix

(RHSA-2022:1440) Important: java-11-openjdk security, bug fix, and enhancement update

2022-04-20T12:19:58
redhat
unix

(RHSA-2022:1443) Important: java-11-openjdk security update

2022-04-20T12:01:49
redhat
unix

(RHSA-2022:2137) Important: java-1.8.0-openjdk security update

2022-05-17T22:32:47
redhat
unix

(RHSA-2022:1492) Important: OpenJDK 8u332 Windows builds release and security update

2022-04-28T18:57:15
redhat
unix

(RHSA-2022:1441) Important: java-11-openjdk security update

2022-04-20T12:00:56
redhat
unix

(RHSA-2022:1491) Important: java-1.8.0-openjdk security update

2022-04-25T15:17:09
redhat
unix

(RHSA-2022:1442) Important: java-11-openjdk security update

2022-04-20T12:24:01
redhat
unix

(RHSA-2022:1488) Important: java-1.8.0-openjdk security update

2022-04-25T14:35:47
redhat
unix

(RHSA-2022:1487) Important: java-1.8.0-openjdk security, bug fix, and enhancement update

2022-04-25T12:35:45
redhat
unix

(RHSA-2022:1489) Important: java-1.8.0-openjdk security update

2022-04-25T14:33:34
oraclelinux
unix

expat security update

2022-03-16T00:00:00
oraclelinux
unix

expat security update

2022-03-28T00:00:00
oraclelinux
unix

kernel security and bug fix update

2022-02-23T00:00:00
oraclelinux
unix

xmlrpc-c security update

2022-11-15T00:00:00
oraclelinux
unix

java-17-openjdk security update

2022-06-30T00:00:00
oraclelinux
unix

java-17-openjdk security and bug fix update

2022-04-20T00:00:00
oraclelinux
unix

java-11-openjdk security update

2022-04-20T00:00:00
centos
unix

expat security update

2022-03-29T22:31:03
centos
unix

bpftool, kernel, perf, python security update

2022-02-25T15:41:18
centos
unix

java security update

2022-05-13T17:34:53
centos
unix

java security update

2022-05-13T17:30:46
cloudlinux
unix

Fixed 13 CVEs in expat

2022-08-17T18:50:48
cloudlinux
unix

Fixed CVEs in java-1.8.0-openjdk: CVE-2022-21434, CVE-2022-21443, CVE-2022-21476, CVE-2022-21426, CVE-2022-21496

2022-06-02T12:59:09
cloudfoundry
software

USN-5288-1: Expat vulnerabilities | Cloud Foundry

2022-04-21T00:00:00
ubuntu
unix

Expat vulnerabilities

2022-02-21T00:00:00
ubuntu
unix

OpenJDK 8 vulnerabilities

2022-08-04T00:00:00
ubuntu
unix

OpenJDK vulnerabilities

2022-08-04T00:00:00
ubuntu
unix

OpenJDK vulnerabilities

2022-04-26T00:00:00
suse
unix

Security update for expat (important)

2022-01-25T00:00:00
suse
unix

Security update for java-1_8_0-openj9 (important)

2022-09-06T00:00:00
suse
unix

Security update for java-1_8_0-openjdk (important)

2022-07-22T00:00:00
suse
unix

Security update for java-11-openjdk (important)

2022-05-03T00:00:00
slackware
unix

[slackware-security] expat

2022-01-16T21:48:11
mageia
unix

Updated expat packages fix security vulnerability

2022-01-25T12:13:11
mageia
unix

Updated java packages fix security vulnerability

2022-07-16T19:58:20
hp
software

Expat Library update for Teradici PCoIP Software and Firmware

2022-04-11T00:00:00
osv
software

expat - security update

2022-02-12T00:00:00
osv
software

expat - security update

2022-01-30T00:00:00
osv
software

openjdk-17 - security update

2022-05-03T00:00:00
osv
software

openjdk-11 - security update

2022-05-05T00:00:00
osv
software

openjdk-8 - security update

2022-05-14T00:00:00
debian
unix

[SECURITY] [DLA 2904-1] expat security update

2022-01-30T21:42:20
debian
unix

[SECURITY] [DSA 5073-1] expat security update

2022-02-12T13:32:08
debian
unix

[SECURITY] [DSA 5128-1] openjdk-17 security update

2022-05-03T21:01:53
debian
unix

[SECURITY] [DSA 5131-1] openjdk-11 security update

2022-05-05T17:16:55
debian
unix

[SECURITY] [DLA 3006-1] openjdk-8 security update

2022-05-14T09:20:52
amazon
unix

Medium: expat

2022-07-06T03:09:00
amazon
unix

Medium: expat

2022-06-30T23:38:00
amazon
unix

Important: java-17-amazon-corretto

2022-04-25T23:54:00
amazon
unix

Important: java-11-amazon-corretto

2022-04-25T22:55:00
aix
unix

AIX is affected by multiple vulnerabilities in Python

2022-07-28T13:12:18
gentoo
unix

Expat: Multiple Vulnerabilities

2022-09-29T00:00:00
rocky
unix

java-17-openjdk security and bug fix update

2022-04-20T00:00:00
f5
software

Multiple Java vulnerabilities CVE-2022-21426, CVE-2022-21434, CVE-2022-21443, CVE-2022-21449, CVE-2022-21476 and CVE-2022-21496

2022-05-27T07:08:00
kaspersky
info

KLA12516 Multiple vulnerabilities in Oracle Java SE and GraalVM

2022-04-19T00:00:00
photon
unix

Critical Photon OS Security Update - PHSA-2022-0353

2022-01-19T00:00:00
altlinux
unix

Security fix for the ALT Linux 10 package java-1.8.0-openjdk version 0:1.8.0.332.b09-alt0_0.1.eajpp8

2022-04-27T00:00:00
altlinux
unix

Security fix for the ALT Linux 10 package java-11-openjdk version 0:11.0.15.0.10-alt1_1jpp11

2022-07-14T00:00:00