CentOS 8 : squid:4 (CESA-2022:5526)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2022:5526 advisory. - squid: DoS when processing gopher server responses CVE-2021-46784 Note that Nessus has not tested for this issue but has instead relied only on the...

phpMyAdmin 4.x < 4.8.3 Cross-Site Scripting

The version of phpMyAdmin installed on the remote host does not correctly handle malicious filenames leading to a leading to a Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version numbe...

RHEL 8 : squid:4 (RHSA-2022:5528)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5528 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: DoS when...

RHEL 8 : squid:4 (RHSA-2022:5529)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:5529 advisory. Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. Security Fixes: squid: DoS when...

Fedora: Security Advisory for golang-gopkg-src-d-git-4 (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

AZL-10108 CVE-2022-33744 affecting package kernel for versions less than 5.15.67.1-4

Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the related lock held, resulting in a small race window, which can be used by unprivileged...

[SECURITY] Fedora 36 Update: xq-0.0.7-4.fc36

Command line XML beautifier and content extractor. Similar to jq...

[SECURITY] Fedora 36 Update: golang-gopkg-src-d-git-4-4.13.1-8.fc36

A highly extensible git implementation in pure go...

[SECURITY] Fedora 36 Update: golang-github-containernetworking-cni-1.1.1-4.fc36

Container Network Interface - networking for Linux containers...

[SECURITY] Fedora 36 Update: golang-github-akavel-rsrc-0.10.2-4.fc36

Tool for embedding binary resources in Go programs...

szenenwelt.de Cross Site Scripting vulnerability OBB-2717650

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-9FMG-89FX-R33W Quadratic blowup in Convert::xml2array()

Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array that enables a remote attack via a crafted XML document...

Vulnerabilities & Threats that Matter 20 June – 26 June 2022

Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 413 14 4 121 19 33 For a detailed threat digest, download the pdf file here Summary The last week of June 2022 witnessed the discovery of 413 vulnerabilities out of which ...

CVE-2021-4206 affecting package qemu for versions less than 6.2.0-4

CVE-2021-4206 affecting package qemu for versions less than 6.2.0-4. A patched version of the package is available...

CVE-2022-32399

Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/crimes/viewcrime.php:4...

AZL-45294 CVE-2022-29526 affecting package containernetworking-plugins for versions less than 1.6.1-4

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

MAL-2022-2924 Malicious code in express-4.x-passport-snapchat-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d0ca6535a564c08a2ffa5c45fb5ec728ccbdb49e6b49c6dcea0320b08f6bae7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eccdea200d6fdfa580033d99febead41c310ba6df3eea70c6f8594521182cab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2868 Malicious code in ethers-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eccdea200d6fdfa580033d99febead41c310ba6df3eea70c6f8594521182cab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Spring Tools 4.15.1 released

Dear Spring Community, I am happy to announce the 4.15.1 release of the Spring Tools 4 for Eclipse, Visual Studio Code, and Theia. fixes and improvements Spring Boot fixed: VScode incorrectly suggests removing @Autowired annotation from methods 787 Spring Boot fixed: VScode quick fix should not...