Fedora: Security Advisory (FEDORA-2023-8f8ddb2428)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints

Three interrelated high-severity security flaws discovered in Kubernetes could be exploited to achieve remote code execution with elevated privileges on Windows endpoints within a cluster. The issues, tracked as CVE-2023-3676, CVE-2023-3893, and CVE-2023-3955, carry CVSS scores of 8.8 and impact...

Important: Red Hat Security Advisory: Red Hat OpenShift support for Windows Containers 5.1.2 security update

The components for Red Hat OpenShift support for Windows Containers 5.1.2 are now available. This product release includes bug fixes and security updates for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this...

Important: Red Hat Security Advisory: Red Hat OpenShift support for Windows Containers 6.0.2 security update

The components for Red Hat OpenShift support for Windows Containers 6.0.2 are now available. This product release includes bug fixes and security updates for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this...

Important: Red Hat Security Advisory: Red Hat OpenShift support for Windows Containers 7.1.1 security update

The components for Red Hat OpenShift support for Windows Containers 7.1.1 are now available. This product release includes bug fixes and security updates for the following packages: windows-machine-config-operator and windows-machine-config-operator-bundle. Red Hat Product Security has rated this...

SUSE CVE-2016-3955

The usbiprecvxbuff function in drivers/usb/usbip/usbipcommon.c in the Linux kernel before 4.5.3 allows remote attackers to cause a denial of service out-of-bounds write or possibly have unspecified other impact via a crafted length value in a USB/IP packet...

CVE-2022-3955

creationtimestamp| type| source ---|---|--- 2022-11-13 05:45:11+00:00| seen| https://t.me/cibsecurity/52881...

CVE-2022-3955 tholum crm42 Login class.user.php sql injection

A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit h...

CVE-2022-3955

The CVE-2022-3955 entry concerns tholum crm42, specifically the Login component’s file crm42\class\class.user.php. The vulnerability arises from improper handling of the user_name argument, enabling SQL injection. It is described as exploitable remotely with a critical/high impact profile across ...

SUSE: Security Advisory (SUSE-SU-2016:2245-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2012:1327-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

VMSA-2020-0008 : VMware ESXi patches address Stored Cross-Site Scripting (XSS) vulnerability

a. VMware ESXi patches address Stored Cross-Site Scripting XSS vulnerability CVE-2020-3955 Description : The VMware ESXi Host Client does not properly neutralize script-related HTML when viewing virtual machines attributes. A malicious actor with access to modify the system properties of a virtua...

CVE-2020-3955

ESXi 6.5 without patch ESXi650-201912104-SG and ESXi 6.7 without patch ESXi670-202004103-SG do not properly neutralize script-related HTML when viewing virtual machines attributes. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base sco...

CVE-2020-3955

CVE-2020-3955 affects VMware ESXi 6.5 and 6.7 via a stored XSS in the ESXi Host Client when viewing virtual machine attributes. The underlying issue is improper neutralization of script-related HTML, allowing an authenticated attacker who can modify VM properties (e.g., hostname) to inject script...

RHEL 6 : chromium-browser (RHSA-2019:3955)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:3955 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 78.0.3904.108. Security Fixes:...

CVE-2019-3955

Dameware Remote Mini Control (SolarWinds) versions up to 12.1.0.34 are affected by an unauthenticated heap overflow bug caused by the server failing to validate RsaPubKeyLen during key negotiation. An attacker could trigger a heap buffer overflow remotely, potentially leading to denial of service...

Ubuntu 16.04 LTS / 18.04 LTS : tcpflow vulnerabilities (USN-3955-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3955-1 advisory. It was discovered that tcpflow incorrectly handled certain malformed network packets. A remote attacker could send these packets to a target...

Linksys ESeries OS Command Injection (CVE-2018-3953; CVE-2018-3954; CVE-2018-3955)

A command injection vulnerability exists in the Linksys E Series line of routers. An attacker can exploit these bugs by sending an authenticated HTTP request to the network configuration service. An attacker could then gain the ability to arbitrarily execute code on the machine...

CVE-2018-3955

creationtimestamp| type| source ---|---|--- 2018-10-17 15:21:09+00:00| seen| MISP/5bc752ce-d1e8-4326-876d-08c10a021402...

CVE-2018-3955

CVE-2018-3955 affects Linksys E-Series: E1200 (firmware 2.0.09) and E2500 (3.0.04). It enables OS command injection via authenticated HTTP requests to apply.cgi by passing user-controlled data (wan_domain or machine_name) that flows through nvram_set and a preinit path, eventually invoking set_ho...