Upgraded Q -> 2 from #273 [1692910023114]

Judge has assessed an item in Issue 273 as 2 risk. The relevant finding follows: L-01 --- The text was updated successfully, but these errors were encountered: All reactions...

Cisco Nexus 3000 9000 Series Switches IS-IS Protocol DoS (cisco-sa-nxos-n3_9k-isis-dos-FTCXB4Vb)

A vulnerability in the Intermediate System-to-Intermediate System IS-IS protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / dtb-al / dtb-zte / etc (SUSE-SU-2023:3391-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3391-1 advisory. The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. The following security...

XWiki 4.3-milestone-2 < 14.10.5 Privilege Escalation Vulnerability (GHSA-5mf8-v43w-mfxp)

XWiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...

SUSE SLED15: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2023:3395-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3395-1 advisory. - CVE-2023-20569: Fixed side channel attack Inception or RAS Poisoning. bsc1214082, XSA-434 -...

Amazon Linux 2023 : nerdctl (ALAS2023-2023-313)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-313 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...

Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol Denial of Service Vulnerability

A vulnerability in the Intermediate System-to-Intermediate System IS-IS protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the IS-IS process to...

Amazon Linux 2 : log4j (ALAS-2022-1739)

The version of log4j installed on the remote host is prior to 1.2.17-17. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1739 advisory. A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code o...

Amazon Linux 2 : spice-protocol (ALAS-2023-2219)

The version of spice-protocol installed on the remote host is prior to 0.12.14-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2219 advisory. Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A...

Amazon Linux 2 : ghostscript (ALAS-2023-2204)

The version of ghostscript installed on the remote host is prior to 9.25-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2204 advisory. A buffer overflow flaw was found in base/gdevdevn.c:1973 in devnpcxwriterle in ghostscript. This issue may allow a local attacke...

Amazon Linux 2 : libgovirt (ALAS-2023-2220)

The version of libgovirt installed on the remote host is prior to 0.3.4-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2220 advisory. Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A...

Amazon Linux 2 : exiv2 (ALAS-2023-2215)

The version of exiv2 installed on the remote host is prior to 0.27.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2215 advisory. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. ...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2023-028)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2023-028 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chain...

Amazon Linux 2 : libjpeg-turbo (ALAS-2023-2214)

The version of libjpeg-turbo installed on the remote host is prior to 2.0.90-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2214 advisory. The PPM reader in libjpeg-turbo through 2.0.90 mishandles use of tjLoadImage for loading a 16-bit binary PPM file into a...

Amazon Linux 2 : runc (ALASDOCKER-2023-028)

The version of runc installed on the remote host is prior to 1.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-028 advisory. The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additiona...

Amazon Linux 2 : kernel (ALAS-2023-2206)

The version of kernel installed on the remote host is prior to 4.14.322-244.536. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2206 advisory. A buffer overrun vulnerability was found in the netback driver in Xen due to an unusual split packet. This flaw...

Amazon Linux 2 : golang (ALAS-2023-2211)

The version of golang installed on the remote host is prior to 1.20.7-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2211 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a...

Amazon Linux 2 : libtiff (ALAS-2023-2212)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2212 advisory. 2023-08-31: CVE-2022-2953 was added to this advisory. 2023-08-31: CVE-2022-2520 was added to this advisory. 2023-08-31:...

Amazon Linux 2 : containerd (ALASDOCKER-2023-027)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2023-027 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can...

Amazon Linux 2 : containerd (ALASDOCKER-2023-029)

The version of containerd installed on the remote host is prior to 1.6.19-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2023-029 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 Large handshake records may cause panics...