EulerOS 2.0 SP3 : unzip (EulerOS-SA-2022-1768)

According to the versions of the unzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound...

EulerOS 2.0 SP3 : zlib (EulerOS-SA-2022-1777)

According to the versions of the zlib packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 Note that...

EulerOS 2.0 SP3 : php (EulerOS-SA-2022-1755)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexmlloadfile, URL-decode th...

EulerOS 2.0 SP3 : spamassassin (EulerOS-SA-2022-1764)

According to the versions of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration .cf files can be...

EulerOS 2.0 SP3 : xorg-x11-server (EulerOS-SA-2022-1773)

According to the versions of the xorg-x11-server packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the...

EulerOS 2.0 SP3 : libreswan (EulerOS-SA-2022-1738)

According to the versions of the libreswan package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity...

EulerOS 2.0 SP3 : nfs-utils (EulerOS-SA-2022-1748)

According to the versions of the nfs-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The nfs-utils package in SUSE Linux Enterprise Server 12 before and including version 1.3.0-34.18.1 and in SUSE Linux Enterprise Server 15...

EulerOS 2.0 SP3 : java-1.8.0-openjdk (EulerOS-SA-2022-1733)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization. Supported...

EulerOS 2.0 SP3 : gstreamer-plugins-bad-free (EulerOS-SA-2022-1727)

According to the versions of the gstreamer-plugins-bad-free package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an...

EulerOS 2.0 SP3 : python-paramiko (EulerOS-SA-2022-1759)

According to the versions of the python-paramiko package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Paramiko before 2.10.1, a race condition between creation and chmod in the writeprivatekeyfile function could allow unauthorized...

EulerOS 2.0 SP3 : gzip (EulerOS-SA-2022-1728)

According to the versions of the gzip package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, ...

openSUSE: Security Advisory for slurm_20_11 (SUSE-SU-2022:1831-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CLink Office 2.0 SQL Injection Vulnerability

Exploit Title: Multiple blind SQL injection vulnerabilities in in CLink Office 2.0 Anti-Spam management console Exploit Author: Erwin Chan, Stephen Tsoi Vendor Homepage: https://www.communilink.net/ Softwar: CLink Office Version: 2.0 Tested on: CLink Office 2.0 Anti-Spam management console...

Mattermost Server mishandles redirect denial action

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection...

GHSA-W8CC-3H7Q-JHC3 Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

CLink Office 2.0 SQL Injection

Exploit Title: Multiple blind SQL injection vulnerabilities in in CLink Office 2.0 Anti-Spam management console Date: 30 Mar 2022 Exploit Author: Erwin Chan, Stephen Tsoi Vendor Homepage: https://www.communilink.net/ Softwar: CLink Office Version: 2.0 Tested on: CLink Office 2.0 Anti-Spam...

CVE-2019-11066

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method...

RHEL 8 : container-tools:2.0 (RHSA-2022:4651)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4651 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: psgo:...

RubyGems Improper Input Validation vulnerability

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original...

Session Fixation in ipsilon

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active...