Ubuntu: Security Advisory (USN-5241-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2887-1 : lighttpd - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2887 advisory. - An issue was discovered in modaliasphysicalhandler in modalias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a single directory above an alias...

Adobe ColdFusion 2016 < 2016 Update 17 / 2018 < 2018 Update 11 / 2021 < 2021 Update 1 Cross-Site Scripting

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by a Cross-site Scripting XSS vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code in context of the current user. No source data...

SUSE: Security Advisory (SUSE-SU-2022:0080-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2022:0068-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: kernel-azure / kernel-azure-base / kernel-azure-devel / etc (SUSE-SU-2022:0080-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0080-1 advisory. The SUSE Linux Enterprise 12 SP5 kernel was updated. The following security bugs were fixed: - CVE-2021-4083: Fixed a race conditio...

SUSE SLED15 / SLES15 Security Update : libmspack (SUSE-SU-2022:0069-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0069-1 advisory. - CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection bsc1113040...

SUSE-SU-2022:0069-1 Security update for libmspack

This update for libmspack fixes the following issues: - CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash protection bsc1113040...

CVE-2018-15687

A race condition in chownone of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239...

CVE-2018-5740

A denial of service flaw was discovered in bind versions that include the "deny-answer-aliases" feature. This flaw may allow a remote attacker to trigger an INSIST assert in named leading to termination of the process and a denial of service condition. Mitigation Disabling the "deny-answer-aliase...

CVE-2018-15908

It was discovered that the ghostscript .tempfile function did not properly handle file permissions. An attacker could possibly exploit this to exploit this to bypass the -dSAFER protection and delete files or disclose their content via a specially crafted PostScript document. Mitigation Please se...

CVE-2018-14619

A flaw was found in the crypto subsystem that allowed an attacker to crash the system or possibly escalate privileges with a specially crafted program...

Security update for libmspack (low)

openSUSE Security Update: Security update for libmspack Announcement ID: openSUSE-SU-2022:0069-1 Rating: low References: 1113040 Cross-References: CVE-2018-18586 CVSS scores: CVE-2018-18586 NVD : 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected Products: openSUSE Leap 15.3 An update that...

VulnCheck KEV: CVE-2018-3948

An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause the server to stop responding to requests, resulting in downtime for the management portal. An attacker can send either an...

Fix of 14 CVEs

CVE-2018-9138: Fix stack exhaustion - CVE-2018-12641: Fix stack exhaustion - CVE-2018-12697: Fix NULL pointer dereference - CVE-2018-12698: Fix memory consumption - CVE-2018-12699: Fix heap-based buffer overflow - CVE-2018-12700: Fix infinite recursion - CVE-2018-17794: Fix NULL pointer...

acto-rs (>=0.2.9, <=0.3.7), alumina (>=0.1.0, <=0.1.1) +337 more potentially affected by CVE-2018-25023 via smallvec (>=0.1.8, <=0.5.1)

smallvec CARGO version =0.1.8, =0.2.9, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.55 and more Source cves: CVE-2018-25023 Source advisory: OSV:GHSA-55M5-WHCV-C49C...

async-fetcher (>=0.1.1, <=0.1.2), exonum (0.9.7) +2 more potentially affected by CVE-2018-25024 +2 more via actix-web (>=0.2.1, <=0.7.3)

actix-web CARGO version =0.2.1, =0.1.1, =0.1.0, =0.1.3 - sockjs 0.1.0 Source cves: CVE-2018-25024, CVE-2018-25025, CVE-2018-25026 Source advisory: OSV:GHSA-FGFM-HQJW-3265...

@hola.org/har-validator (2.0.6-hola.1), @hola.org/request (>=2.67.0-hola.5, <=2.67.0-hola.6) +46 more potentially affected by CVE-2018-1107 via is-my-json-valid (>=2.10.1, <=2.17.1)

is-my-json-valid NPM version =2.10.1, =2.67.0-hola.5, =2.67.0-lum.3, =1.0.1, =1.2.0, =1.0.0, =0.4.0, =1.0.0, =0.4.1, =0.0.1, =0.0.10 - fsa-creator 0.1.1 - geojsonvalidator 0.0.1 and more Source cves: CVE-2018-1107 Source advisory: OSV:GHSA-4HPF-3WQ7-5RPR...

PT-2022-12579

Name of the Vulnerable Software and Affected Versions Honda Civic 2012 Honda X-RV 2018 Honda C-RV 2020 Honda Accord 2020 Honda Odyssey 2020 Honda Inspire 2021 Honda Fit 2022 Honda Civic 2022 Honda VE-1 2022 Honda Breeze 2022 Description The keyfob subsystem in Honda vehicles allows a replay attac...

jncocreation.com Cross Site Scripting vulnerability OBB-2321547

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...