Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Deployment Intelligence app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2020-24025 DESCRIPTION: node-sass...

GHSA-XXW3-765M-F37P SaltStack Salt Improper Authentication vulnerability

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheelasync client. Thus, an attacker can remotely run any wheel modules on the master...

Silverstripe CMS malicious file upload enables script execution

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions for example HTML code in a TXT file. When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Upload...

GHSA-H77W-655F-6J3M Silverstripe CMS malicious file upload enables script execution

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions for example HTML code in a TXT file. When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Upload...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2020-1724 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

com.lookout.jenkins:environment-script (>=1.2, <=1.2.3), org.jenkins-ci.main:jenkins-test-harness (1.565) +26 more potentially affected by CVE-2020-2100 via org.jenkins-ci.main:jenkins-core (1.565)

org.jenkins-ci.main:jenkins-core MAVEN version 1.565 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.lookout.jenkins:environment-script =1.2, =1.0, =0.1, =2.0, =1.23, =1.0.0, =1.0-beta-1, =1.3...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

com.foreach.across.modules:across-hibernate-module (4.0.0.release), com.foreach.across.modules:admin-web-module (4.0.0.release) +171 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.1.13.release)

org.springframework:spring-web MAVEN version 5.1.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.foreach.across.modules:across-hibernate-module 4.0.0.release -...

org.hibernate:hibernate-search-infinispan (5.0.0.beta1), org.hibernate:hibernate-search-modules (5.0.0.beta1) +29 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.0.0.cr2)

org.infinispan:infinispan-core MAVEN version 7.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.hibernate:hibernate-search-infinispan 5.0.0.beta1 - org.hibernate:hibernate-search-modules...

org.infinispan:infinispan-as-embedded-modules (7.0.1.final), org.infinispan:infinispan-cachestore-jdbc (7.0.1.final) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.0.1.final)

org.infinispan:infinispan-core MAVEN version 7.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.0.1.final -...

org.infinispan:infinispan-as-embedded-modules (7.1.0.beta1), org.infinispan:infinispan-cachestore-jdbc (7.1.0.beta1) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.1.0.beta1)

org.infinispan:infinispan-core MAVEN version 7.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.1.0.beta1 -...

com.opennewway:onw-test (1.0d11), com.opennewway:onw-web (1.0d11) +43 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (5.2.6.final)

org.infinispan:infinispan-core MAVEN version 5.2.6.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - com.opennewway:onw-test 1.0d11 - com.opennewway:onw-web 1.0d11 -...

org.infinispan:infinispan-as-embedded-modules (7.1.0.cr1), org.infinispan:infinispan-cachestore-jdbc (7.1.0.cr1) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.1.0.cr1)

org.infinispan:infinispan-core MAVEN version 7.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.1.0.cr1 -...

GHSA-PM48-CVV2-29Q5 Ansible Uses Plugins That Disclose Credentials

Ansible, all ansibleengine-2.x versions and ansibleengine-3.x up to ansibleengine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed i...

GHSA-MWH9-GR45-XVV4 Mule modules contain Directory Traversal

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway all versions released before August 1, 2019 allow remote attackers to read files accessible to the Mule process...

Mule modules contain Directory Traversal

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway all versions released before August 1, 2019 allow remote attackers to read files accessible to the Mule process...

Magento 2 Community Edition Session Fixation Check

A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2...

[SECURITY] Fedora 36 Update: slurm-21.08.8-2.fc36

Slurm is an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for Linux clusters. Components include machine status, partition management, job management, scheduling and accounting modules...

new packages: environment-modules

An update is available for environment-modules. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rock...

new packages: varnish-modules

An update is available for varnish-modules. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...