Fedora: Security Advisory for yarnpkg (FEDORA-2023-18fd476362)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 36 : yarnpkg (2023-18fd476362)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-18fd476362 advisory. Add patches for CVE-2021-43138, CVE-2022-3517, CVE-2020-7677 Tenable has extracted the preceding description block directly from the Fedora security...

CVE-2022-43138

creationtimestamp| type| source ---|---|--- 2022-11-17 20:17:55+00:00| seen| https://t.me/cibsecurity/53075 2025-04-30 14:12:55+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14031...

CVE-2022-43138

CVE-2022-43138 affects Dolibarr Open Source ERP & CRM for Business, prior to v14.0.1. The vulnerability arises from a privilege-escalation flaw in the API surface, allowing an attacker with no privileges to achieve unauthorized high-privilege access. The CVSS metrics indicate a CRITICAL impact (C...

IBM Cognos Analytics Multiple Vulnerabilities (6828527)

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following: - OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the EVPPKEYdecrypt function within implementation of the SM2 decryption. By sendin...

CVE-2021-43138

A vulnerability was found in the async package. This flaw allows a malicious user to obtain privileges via the mapValues method...

Security Bulletin: IBM Robotic Process Automation is vulnerable to arbitrary code execution due to async (CVE-2021-43138)

Summary async is used by IBM Robotic Process Automation as part of control center UI functionality. CVE-2021-43138 Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution in the mapValues...

Security Bulletin: Vulnerability in async opensource package affects IBM VM Recovery Manager HA & DR GUI

Summary There is vulnerability in async opensource package which affects IBM VM Recovery Manager HA and DR GUI. No impacts to VM Recovery Manager HA and DR cli. Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution due to async ( CVE-2021-43138) and nconf (CVE-2022-21803)

Summary IBM Integration Bus and IBM App Connect Enterprise are vulnerable to arbitrary code execution, due to the async CVE-2021-43138 and nconf CVE-2022-21803 modules for Node.js. A mitigation has been provided for IBM Integration Bus. The latest fix packs for IBM App Connect Enterprise includes...

Security Bulletin: Remote code execution vulnerability affect IBM Business Automation Workflow - CVE-2021-43138

Summary IBM Business Automation Workflow is vulnerable to a remote code execution attack. Vulnerability Details CVEID:CVE-2021-43138 DESCRIPTION: Async could allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution in the mapValues method. By persuading a...

CVE-2021-43138

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues method, aka lib/internal/iterator.js createObjectIterator prototype pollution...

CVE-2021-43138

CVE-2021-43138 affects Async (lib/iterator.js) where mapValues() enables prototype pollution via createObjectIterator, allowing a malicious user to obtain privileges. Affected: Async before 2.6.4 and 3.x before 3.2.2. Root cause: prototype pollution in Object prototype through pollution of mapVal...