Amazon Linux 2 : djvulibre (ALASMATE-DESKTOP1.X-2023-001)

The version of djvulibre installed on the remote host is prior to 3.5.27-30. It is, therefore, affected by a vulnerability as referenced in the ALAS2MATE-DESKTOP1.X-2023-001 advisory. An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode in DjVuText.cpp via a crafte...

Amazon Linux 2 : nginx (ALASNGINX1-2023-005)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-005 advisory. The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, befor...

Amazon Linux 2 : mono (ALASMONO-2023-001)

It is, therefore, affected by a vulnerability as referenced in the ALAS2MONO-2023-001 advisory. SharpZipLib or ziplib is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt may be extracted in the parent directory of destFolder. This leads to arbitrary file...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-001)

The version of tomcat installed on the remote host is prior to 9.0.76-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-001 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2023-004)

The version of tomcat installed on the remote host is prior to 9.0.65-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2023-004 advisory. A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, transitively...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-003)

The version of postgresql installed on the remote host is prior to 13.3-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-003 advisory. A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let...

Amazon Linux 2 : postgresql (ALASPOSTGRESQL13-2023-001)

The version of postgresql installed on the remote host is prior to 13.11-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL13-2023-001 advisory. postgresql: Client memory disclosure when connecting with Kerberos to modified server CVE-2022-41862 This...

Amazon Linux 2 : libtommath (ALASANSIBLE2-2023-010)

The version of libtommath installed on the remote host is prior to 1.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-010 advisory. Integer Overflow vulnerability in mpgrow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9,...

Amazon Linux 2 : firefox (ALASFIREFOX-2023-012)

The version of firefox installed on the remote host is prior to 91.13.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2023-012 advisory. A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Mozilla developers an...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-001)

The version of ruby installed on the remote host is prior to 2.6.10-129. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY2.6-2023-001 advisory. A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that...

Amazon Linux 2 : libreoffice (ALASLIBREOFFICE-2023-001)

The version of libreoffice installed on the remote host is prior to 5.3.6.1-21. It is, therefore, affected by a vulnerability as referenced in the ALAS2LIBREOFFICE-2023-001 advisory. A flaw was found in the Libreoffice package. An attacker can craft an odb containing a database/script file with a...

Amazon Linux 2 : nginx (ALASNGINX1-2023-002)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-002 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but...

Amazon Linux 2 : redis (ALASREDIS6-2023-008)

The version of redis installed on the remote host is prior to 6.2.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-008 advisory. Redis is an open source BSD licensed, in-memory data structure store, used as a database, cache, and message broker. An...

Amazon Linux 2 : redis (ALASREDIS6-2023-002)

The version of redis installed on the remote host is prior to 6.2.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2REDIS6-2023-002 advisory. A heap-based buffer overflow flaw was found in Redis. This flaw allows an attacker to trick an authenticated user into executin...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-013)

The version of tomcat installed on the remote host is prior to 8.5.87-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-013 advisory. A privilege escalation flaw was found in Tomcat when the JMX Remote Lifecycle Listener was enabled. A local attack...

Amazon Linux 2 : ruby (ALASRUBY2.6-2023-002)

The version of ruby installed on the remote host is prior to 2.6.9-129. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2RUBY2.6-2023-002 advisory. A flaw was found in ruby, where the date object was found to be vulnerable to a regular expression denial of service...

Amazon Linux 2 : redis (ALASREDIS6-2023-007)

The version of redis installed on the remote host is prior to 6.2.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2REDIS6-2023-007 advisory. Redis is an open source, in-memory database that persists on disk. In affected versions specially crafted Lua scripts...

Essential Guide to Cybersecurity Compliance

SOC 2, ISO, HIPAA, Cyber Essentials – all the security frameworks and certifications today are an acronym soup that can make even a compliance expert's head spin. If you're embarking on your compliance journey, read on to discover the differences between standards, which is best for your business...

Suprema BioStar 2

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Suprema Inc. Equipment : BioStar 2 Vulnerability : SQL Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

Ubuntu 16.04 ESM / 18.04 ESM : CUPS vulnerability (USN-6361-2)

The remote Ubuntu 16.04 ESM / 18.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-6361-2 advisory. USN-6361-1 fixed a vulnerability in CUPS. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Tenable has...