Oracle Linux 8 : linux-firmware (ELSA-2023-12691)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12691 advisory. 20230516-999.22.git6c9e0ed5.el8 - remove amd-ucode/README Orabug: 35645306 - Resolves 'Zenbleed' Orabug: 35650345 CVE-2023-20593 Tenable has extracted the...

[SECURITY] [DSA 5461-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5461-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 30, 2023 https://www.debian.org/security/faq -...

‘Call of Duty: Modern Warfare 2’ Players Hit With Worm Malware

Plus: Russia tightens social media censorship, new cyberattack reporting rules for US companies, and Google Street View returns to Germany...

SUSE SLES15 Security Update : kernel-firmware (SUSE-SU-2023:3020-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3020-1 advisory. - CVE-2023-20593: Fixed AMD ucode for ZenBleed vulnerability bsc1213286. Tenable has extracted the preceding description block directly from...

openSUSE 15: kernel-firmware / kernel-firmware-all / kernel-firmware-amdgpu / etc (SUSE-SU-2023:3022-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:3022-1 advisory. - CVE-2023-20593: Fixed AMD ucode for ZenBleed vulnerability bsc1213286. Tenable has extracted the preceding description block directly from the SUSE securit...

CVE-2023-1786 affecting package cloud-init 21.4-2

CVE-2023-1786 affecting package cloud-init 21.4-2. A patched version of the package is available...

CVE-2023-31486 affecting package perl 5.30.3-2

CVE-2023-31486 affecting package perl 5.30.3-2. A patched version of the package is available...

CVE-2022-31454

Yii 2 v2.0.45 was discovered to contain a cross-site scripting XSS vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2...

Cross site scripting

Yii 2 v2.0.45 was discovered to contain a cross-site scripting XSS vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2...

Yii 跨站脚本漏洞

Yii is a component-based, high-performance PHP framework for developing large-scale web applications developed by the YII team. A cross-site scripting vulnerability exists in Yii 2 v2.0.45, which originates from endpoint books containing cross-site scripting XSS...

SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2023:3006-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3006-1 advisory. The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

CVE-2022-31454

Yii 2 v2.0.45 was discovered to contain a cross-site scripting XSS vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2...

java-17-openjdk security and bug fix update

1:17.0.8.0.7-2.0.1 - OpenJDK: ZIP file parsing infinite loop 8302483 CVE-2023-22036 - OpenJDK: weakness in AES implementation 8308682 CVE-2023-22041 - OpenJDK: improper handling of slash characters in URI-to-path conversion 8305312 CVE-2023-22049 - harfbuzz: OpenJDK: On^2 growth via consecutive...

CVE-2022-31454

The connected sources confirm a cross-site scripting (XSS) vulnerability in Yii 2.0.45 exposed via the /books endpoint. The claim is that /books relates to Yii 2 is disputed by the vendor. Technical details on the underlying root cause, exploit steps, impacted versions beyond 2.0.45, and confirme...

SUSE SLES12 Security Update : kernel-firmware (SUSE-SU-2023:3001-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3001-1 advisory. - CVE-2023-20593: Fixed AMD ucode for ZenBleed vulnerability bsc1213286. Tenable has extracted the preceding description block directly from...

CVE-2022-31454

Yii 2 v2.0.45 was discovered to contain a cross-site scripting XSS vulnerability via the endpoint /books. NOTE: this is disputed by the vendor because the cve-2022-31454-8e8555c31fd3 page does not describe why /books has a relationship to Yii 2...

CVE-2021-36580

Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 13.0.1.2 via the referer parameter...

K000135632: AMD Ryzen vulnerability CVE-2023-20593

Security Advisory Description An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. CVE-2023-20593 also known as Zen Bleed Vulnerability Impact There is no impact; F5 products are not affected by this...

sails-hook-api-version-accept (0.1.0), sails-hook-route (>=0.0.1, <=0.0.4) potentially affected by CVE-2023-38504 via sails (>=1.0.1, <=1.0.3-2)

sails NPM version =1.0.1, =0.0.1, =0.0.4 Source cves: CVE-2023-38504 Source advisory: OSV:GHSA-GPW9-FWM8-7RX7...

Authentication Bypass

github.com/envoyproxy/envoy is vulnerable to Authentication Bypass. The library supports mixed-case schemes for HTTP/2; however, internal checks that are case-sensitive may result in rejections or bypasses in unencrypted connections, possibly harming htTp and htTps requests...