RHCOS 4 : Red Hat OpenShift Enterprise (RHSA-2023:3910)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3910 advisory. - golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests CVE-2022-41717 - openshift: OCP & FIPS mode...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-058)

The version of kernel installed on the remote host is prior to 5.4.266-178.365. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.4-2024-058 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This...

RHCOS 4 : OpenShift Container Platform 4.13.23 (RHSA-2023:7325)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7325 advisory. - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Note that Nessus has not test...

RHCOS 4 : OpenShift Container Platform 4.11.52 (RHSA-2023:5717)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:5717 advisory. - golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-44487 CVE-2023-39325 - HTTP/2: Multiple HTTP/...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2024-005)

The version of postgresql installed on the remote host is prior to 13.13-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2024-005 advisory. Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-046)

The version of kernel installed on the remote host is prior to 5.10.205-195.807. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-046 advisory. An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux...

Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2024-035 (ALASDOCKER-2024-035)

The version of containerd installed on the remote host is prior to 1.7.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2024-035 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version numbe...

Amazon Linux 2 : kernel (ALASKERNEL-5.15-2024-035)

The version of kernel installed on the remote host is prior to 5.15.145-94.156. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.15-2024-035 advisory. An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-005)

The version of libpq installed on the remote host is prior to 14.10-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2POSTGRESQL14-2024-005 advisory. 2024-06-06: CVE-2023-5869 was removed from this advisory.2024-06-06: The severity of this advisory was modified from...

RHCOS 4 : OpenShift Container Platform 4.12.45 (RHSA-2023:7610)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7610 advisory. - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 - python-werkzeug:...

Amazon Linux 2 : firefox (ALASFIREFOX-2024-020)

The version of firefox installed on the remote host is prior to 115.6.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2FIREFOX-2024-020 advisory. A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function...

RHCOS 4 : OpenShift Container Platform 4.11.54 (RHSA-2023:7481)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7481 advisory. - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack Rapid Reset Attack CVE-2023-44487 Note that Nessus has not test...

RHCOS 4 : OpenShift Container Platform 4.13.17 (RHSA-2023:5675)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:5675 advisory. - golang: net/http, x/net/http2: rapid stream resets can cause excessive work CVE-2023-44487 CVE-2023-39325 Note that Nessus has not tested f...

RHCOS 4 : OpenShift Container Platform 4.12.8 (RHSA-2023:1268)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1268 advisory. - golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests CVE-2022-41717 - haproxy: request smuggling...

Cross-site Scripting in Apache superset

A stored cross-site scripting XSS vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their...

CVE-2023-49657

A stored cross-site scripting XSS vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their...

CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title

A stored cross-site scripting XSS vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This co...

CVE-2023-51208

CVE-2023-51208 is rejected/not used; the CNA withdrew this candidate.

Low: containerd

Issue Overview: No CVE associated with this advisory Affected Packages: containerd Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories...