Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-049)

The version of kernel installed on the remote host is prior to 5.10.82-83.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-049 advisory. A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose handler could...

Amazon Linux 2 : snakeyaml (ALAS-2024-2450)

The version of snakeyaml installed on the remote host is prior to 1.11-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2450 advisory. Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

Amazon Linux 2 : sudo (ALAS-2024-2447)

The version of sudo installed on the remote host is prior to 1.8.23-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2447 advisory. 2024-02-22: CVE-2023-42465 was removed from this advisory. 2024-02-22: The severity of this advisory has been changed from important...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-021)

The version of firefox installed on the remote host is prior to 115.7.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2024-021 advisory. An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially...

Amazon Linux 2 : rear (ALAS-2024-2451)

The version of rear installed on the remote host is prior to 2.00-7. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2451 advisory. Relax-and-Recover aka ReaR through 2.7 creates a world-readable initrd when using GRUBRESCUE=y. This allows local attackers to gain...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2024-011)

The version of tomcat installed on the remote host is prior to 9.0.50-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT9-2024-011 advisory. 2024-02-15: CVE-2021-33037 was added to this advisory. Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5...

Amazon Linux 2 : squid (ALAS-2024-2445)

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2445 advisory. Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 throug...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-037)

The version of kernel installed on the remote host is prior to 5.15.93-55.139. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-037 advisory. A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-059)

"The version of kernel installed on the remote host is prior to 5.4.268-181.368. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-059 advisory. 2024-12-05: CVE-2023-52683 was added to this advisory. 2024-12-05: CVE-2023-52679 was added to this...

Amazon Linux 2 : php (ALASPHP8.0-2024-010)

The version of php installed on the remote host is prior to 8.0.24-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.0-2024-010 advisory. 2024-02-15: CVE-2022-31629 was added to this advisory. 2024-02-15: CVE-2022-31628 was added to this advisory. In PHP...

Amazon Linux 2 : containerd (ALASDOCKER-2024-037)

The version of containerd installed on the remote host is prior to 1.7.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2024-037 advisory. 2024-02-15: CVE-2023-39326 was added to this advisory. 2024-02-15: CVE-2023-47108 was added to this advisory. The...

Amazon Linux 2 : java-1.8.0-openjdk (ALAS-2024-2438)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.402.b06-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2438 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engine even...

Amazon Linux 2 : pam (ALAS-2024-2435)

The version of pam installed on the remote host is prior to 1.1.8-23. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2435 advisory. A vulnerability was found in Linux PAM. An unprivileged user that is not yet in a corresponding mount namespace with /tmp mounted as a...

Amazon Linux 2 : webkitgtk4 (ALAS-2024-2434)

The version of webkitgtk4 installed on the remote host is prior to 2.42.4-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2434 advisory. 2024-04-11: CVE-2023-42950 was added to this advisory. A use after free issue was addressed with improved memory...

Amazon Linux 2 : redis (ALASREDIS6-2024-009)

The version of redis installed on the remote host is prior to 6.2.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2024-009 advisory. Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2024-037)

The version of containerd installed on the remote host is prior to 1.7.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2024-037 advisory. 2024-02-15: CVE-2023-39326 was added to this advisory. 2024-02-15: CVE-2023-47108 was added to this...

Amazon Linux 2 : vim (ALAS-2024-2452)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2452 advisory. 2024-02-29: CVE-2023-48706 was added to this advisory. Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a :s command for the very firs...

Amazon Linux 2 : java-11-openjdk (ALASJAVA-OPENJDK11-2024-007)

The version of java-11-openjdk installed on the remote host is prior to 11.0.22.0.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2JAVA-OPENJDK11-2024-007 advisory. A vulnerability that allows an attacker to execute arbitrary java code from the javascript engi...

Amazon Linux 2 : python-pillow (ALAS-2024-2444)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2444 advisory. Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a differe...

U.S. Dept Of Defense: Parâmetro XSS: Nome de usuário - █████████

The report describes a cross-site scripting XSS vulnerability in the username parameter of an application. The vulnerability was demonstrated using Burp Suite, where the attacker was able to inject malicious JavaScript code into the username field. No further details were provided about the...