24195 matches found
Medium: fontforge
Issue Overview: Splinefont in FontForge through 20230101 allows command injection via crafted filenames. CVE-2024-25081 Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. CVE-2024-25082 Affected Packages: fontforge Note: This advisory is...
Medium: pcs
Issue Overview: A Denial of Service DoS vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully crafted content type headers can cause Rack's media type parser to take much longer than expected, leading to a possible denial of service vulnerability. CVE-2024-25126 A Denia...
Important: rust
Issue Overview: RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE: https://github.com/comex/rust-shlex/security/advisories/GHSA-r7qv-8r2h-pg27 Affected Packages: rust Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section f...
Important: apache-commons-compress
Issue Overview: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. CVE-2024-25710 Affected Packages:...
Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-012)
The version of tomcat installed on the remote host is prior to 9.0.83-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2024-012 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through...
Amazon Linux 2 : grub2 (ALAS-2024-2499)
The version of grub2 installed on the remote host is prior to 2.06-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2499 advisory. A flaw was found in the grub2-set-bootflag utility of grub2. After the fix of CVE-2019-14865, grub2-set- bootflag will create a...
Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-010)
The version of libpq installed on the remote host is prior to 14.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-010 advisory. In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos...
Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2024-018)
The version of tomcat installed on the remote host is prior to 8.5.95-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT8.5-2024-018 advisory. Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through...
Amazon Linux 2 : apache-commons-compress (ALAS-2024-2493)
The version of apache-commons-compress installed on the remote host is prior to 1.5-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2493 advisory. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apac...
Amazon Linux 2 : rust (ALAS-2024-2504)
The version of rust installed on the remote host is prior to 1.68.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2504 advisory. RUSTSEC-2024-0006 NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0006.html NOTE:...
Amazon Linux 2 : pcs (ALAS-2024-2492)
The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2492 advisory. A Denial of Service DoS vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully crafted content typ...
RHEL 7 / 8 / 9 : Red Hat JBoss Web Server 5.7.8 (RHSA-2024:1318)
The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1318 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of...
Amazon Linux 2 : ruby (ALAS-2024-2503)
The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2503 advisory. The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant ...
Improper Authentication
wpasupplicant is vulnerable to the Improper Authentication vulnerability. The vulnerability arises because wpasupplicant can be configured to skip TLS certificate verification during Phase 1 authentication, and an eappeapdecrypt vulnerability can then be exploited to bypass Phase 2 authentication...
Denial Of Service (DoS)
org.apache.tomcat, tomcat-coyote is vulnerable to Denial of Service DoS. The vulnerability is due to improper request handling when processing an HTTP/2 request that exceeds any of the configured limits for headers, leading to the associated HTTP/2 stream not being reset until after all of the...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : spectre-meltdown-checker (SUSE-SU-2024:0884-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0884-1 advisory. - updated to 0.46 This release mainly focuses on the detection of the new Zenbleed CVE-2023-20593...
SUSE SLES12 Security Update : spectre-meltdown-checker (SUSE-SU-2024:0885-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0885-1 advisory. - updated to 0.46 This release mainly focuses on the detection of the new Zenbleed CVE-2023-20593 vulnerability, among few other changes tha...
CVE-2021-47120
In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: fix NULL-deref on disconnect Commit 9d7b18668956 "HID: magicmouse: add support for Apple Magic Trackpad 2" added a sanity check for an Apple trackpad but returned success instead of -ENODEV when the check failed...
Security Bulletin: IBM Transformation Extender Advanced is vulnerable to multiple issues due to IBM WebSphere Application Server Liberty.
Summary IBM Transformation Extender Advanced, previously known as IBM Standards Processing Engine, uses IBM WebSphere Application Server Liberty. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons...
