senzeal.com Cross Site Scripting vulnerability OBB-3771872

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fhf-heidelberg.de Cross Site Scripting vulnerability OBB-3771862

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

soosooi.com Cross Site Scripting vulnerability OBB-3771842

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Important: Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

Migration Toolkit for Applications 6.2.1 release Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

BIT-2023-43622

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern.This has been fixed in...

BIT-2023-45802

When a HTTP/2 stream was reset RST frame by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing...

naturelyshop.com.au Cross Site Scripting vulnerability OBB-3771703

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

mrvitamins.com.au Cross Site Scripting vulnerability OBB-3771698

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Amazon Linux 2 : python (ALAS-2023-2330)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2330 advisory. An XML External Entity XXE issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations ...

Amazon Linux 2 : httpd (ALAS-2023-2322)

The version of httpd installed on the remote host is prior to 2.4.58-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2322 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57...

Amazon Linux 2 : kernel (ALAS-2023-2328)

The version of kernel installed on the remote host is prior to 4.14.327-246.539. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2328 advisory. 2024-07-03: CVE-2023-52574 was added to this advisory. 2024-06-06: CVE-2023-52567 was added to this advisory...

Amazon Linux 2 : opensc (ALAS-2023-2323)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2323 advisory. Potential PIN bypass.When the token/card was plugged into the computer and authenticated from one process, it could be use...

Amazon Linux 2 : nautilus (ALAS-2023-2331)

The version of nautilus installed on the remote host is prior to 3.26.3.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2331 advisory. GNOME Nautilus 42.2 allows a NULL pointer dereference and getbasename application crash via a pasted ZIP archive. CVE-2022-3729...

Amazon Linux 2 : cri-tools (ALAS-2023-2324)

The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2324 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : libxml2 (ALAS-2023-2321)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2321 advisory. libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNo...

Amazon Linux 2 : nmap (ALAS-2023-2333)

The version of nmap installed on the remote host is prior to 6.40-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2333 advisory. Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service stack consumption and application...

Amazon Linux 2 : cni-plugins (ALAS-2023-2325)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2325 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : golist (ALAS-2023-2326)

The version of golist installed on the remote host is prior to 0.10.1-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2326 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Amazon Linux 2 : zlib (ALAS-2023-2320)

The version of zlib installed on the remote host is prior to 1.2.7-19. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2320 advisory. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2329)

The version of open-vm-tools installed on the remote host is prior to 12.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2329 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest...