Amazon Linux 2 : webkitgtk4 (ALAS-2023-2270)

The version of webkitgtk4 installed on the remote host is prior to 2.40.5-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2270 advisory. A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 16.4 and iPadOS 16.4,...

Amazon Linux 2 : nasm (ALAS-2023-2277)

The version of nasm installed on the remote host is prior to 2.15.03-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2277 advisory. A Use After Free vulnerability in function newToken in asm/preproc.c in nasm 2.14.02 allows attackers to cause a denial of...

Amazon Linux 2 : poppler (ALAS-2023-2282)

The version of poppler installed on the remote host is prior to 0.26.5-43. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2282 advisory. Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted...

Amazon Linux 2 : bind (ALAS-2023-2273)

The version of bind installed on the remote host is prior to 9.11.4-26.P2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2273 advisory. The code that processes control channel messages sent to named calls certain functions recursively during packet parsing. Recursi...

Amazon Linux 2 : mdadm (ALAS-2023-2275)

The version of mdadm installed on the remote host is prior to 4.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2275 advisory. Buffer overflow in some IntelR SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enab...

Amazon Linux 2 : vim (ALAS-2023-2266)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2266 advisory. vim 8.2.2348 is affected by null pointer dereference, allows local attackers to cause a denial of service DoS via the exbufferall method. CVE-2021-3236 Use After Free in GitHub repository vim/vim...

[SECURITY] Fedora 38 Update: golang-github-nats-io-nkeys-0.4.5-2.fc38

A public-key signature system based on Ed25519 for the NATS ecosystem...

[SECURITY] Fedora 37 Update: pmix-4.1.3-1.fc37

The Process Management Interface PMI has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions PMI-1 and PMI-2 have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1...

[SECURITY] Fedora 38 Update: openmpi-4.1.4-9.fc38

Open MPI is an open source, freely available implementation of both the MPI-1 and MPI-2 standards, combining technologies and resources from several other projects FT-MPI, LA-MPI, LAM/MPI, and PACX-MPI in order to build the best MPI library available. A completely new MPI-2 compliant...

[SECURITY] Fedora 38 Update: pmix-4.1.3-1.fc38

The Process Management Interface PMI has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions PMI-1 and PMI-2 have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1...

SUSE SLES15 Security Update : kernel (Live Patch 2 for SLE 15 SP5) (SUSE-SU-2023:3924-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3924-1 advisory. This update for the Linux Kernel 5.14.21-1505005512 fixes several issues. The following security issues were fixed: - CVE-2023-3776: Fixed...

AZL-31149 CVE-2023-5345 affecting package kernel for versions less than 5.15.135.1-2

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in smb3fscontextparseparam, ctx-password was freed but the field was not set to NULL which could lead to double free. We recommend upgrading pas...

Important: golang

Issue Overview: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the...

asesorapandora.com.ar Cross Site Scripting vulnerability OBB-3720051

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

acg-wien.at Cross Site Scripting vulnerability OBB-3719407

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ubuntu: Security Advisory (USN-6386-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Contact form Form For All Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Contact form Form For All Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5337 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 14aaff51ee15 Credits Lana Codes Require...

SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2023:3903-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3903-1 advisory. - CVE-2023-20588: Fixed AMD CPU transitional execution leak via division by zero XSA-439 bsc1215474. - CVE-2023-34322: Fixed...

SUSE SLES15 Security Update : xen (SUSE-SU-2023:3902-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3902-1 advisory. - CVE-2023-20588: Fixed AMD CPU transitional execution leak via division by zero XSA-439 bsc1215474. - CVE-2023-34322: Fixed...

SUSE SLES15: xen / xen-devel / xen-libs / xen-tools / xen-tools-domU / etc (SUSE-SU-2023:3895-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3895-1 advisory. - CVE-2023-20588: Fixed AMD CPU transitional execution leak via division by zero XSA-439 bsc1215474. - CVE-2023-34322: Fixed...