F5 Networks BIG-IP : BIG-IP Edge Client for Windows vulnerability (K54460845)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.5 / 14.1.4.6 / 15.1.5.1 / 16.1.2.2 / 17.0.0. It is, therefore, affected by a vulnerability as referenced in the K54460845 advisory. - On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to...

[Important] [Security] Virtuozzo ReadyKernel patch 140.0 for Virtuozzo Hybrid Server 7.0, 7.5

The cumulative Virtuozzo ReadyKernel patch was updated with security fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.x. NOTE: No more updates are planned for the kernel 3.10.0-1127.8.2.vz7.151.14. Vulnerability id: CVE-2021-4028 3.10.0-1127.8.2.vz7.158.8 to...

Elasticsearch privilege escalation

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “” index permissions access to this index. Users running a cluster on an affected version...

Ubuntu 16.04 ESM : PHP vulnerabilities (USN-5300-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5300-1 advisory. It was discovered that PHP incorrectly handled certain scripts. An attacker could possibly use this issue to cause a denial of service. CVE-2015-9253,...

Mageia: Security Advisory (MGASA-2014-0149)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2013-0191)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2014-0148)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-23023

On BIG-IP version 16.1.x before 16.1.2.1, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x and 12.1.x, and BIG-IQ all versions of 8.x and 7.x, undisclosed requests by an authenticated iControl REST user can cause an increase in memory resource utilization. Note: Software...

Drupal 7.x < 7.86 Multiple XSS Vulnerabilities (SA-CORE-2022-002) - Linux

Drupal is prone to multiple cross-site scripting XSS vulnerabilities in jQuery UI. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

Drupal 7.x < 7.86 Cross-Site Scripting

According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.86, 9.2.x prior to 9.2.11, or 9.3.x prior to 9.3.3. It is, therefore, affected by multiple cross-site scripting vulnerabilities due to its usage of the third party component jQuery UI...

KLA12427 DoS vulnerability in Oracle Java and GraalVM

Denial of service vulnerability was found in Oracle Java and GraalVM. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Oracle Critical Patch Update Advisory – January 2022 Related products Oracle-Java-JRE-1.7.x Oracle-Java-JRE-1.8.x CVE list...

CVE-2022-22845

QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations...

Code injection

QXIP SIPCAPTURE homer-app before 1.4.28 for HOMER 7.x has the same 167f0db2-f83e-4baa-9736-d56064a5b415 JWT secret key across different customers' installations...

Scientific Linux Security Update : xorg-x11-server on SL7.x i686/x86_64 (2022:0003)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:0003-1 advisory. - xorg-x11-server: SProcRenderCompositeGlyphs out-of-bounds access CVE-2021-4008 - xorg-x11-server: SProcXFixesCreatePointerBarrier out-of-bounds...

Virtuozzo ReadyKernel patch 137.1 for Virtuozzo Hybrid Server 7.0, 7.5

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.x. Vulnerability id: PSBM-136295 3.10.0-1127.8.2.vz7.151.14 to 3.10.0-1160.41.1.vz7.183.5 fs/locks.c: Node crash BUG in locksinsertblock...

CVE-2021-43616

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have bee...

Hitachi Vantara Pentaho 授权问题漏洞

Hitachi Pentaho is a service from Hitachi Japan for storing and managing data in a Big Data environment. An authorization issue vulnerability exists in Hitachi Vantara Pentaho that stems from an issue discovered in Hitachi Vantara Pentaho via 9.1 and Pentaho Business Intelligence Server via 7.x...

Apache Tomcat Session Fixation Vulnerability (Nov 2012) - Linux

Apache Tomcat is prone to a session fixation vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Design/Logic Flaw

Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations...

CVE-2021-23026

BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and 11.6.x and all versions of BIG-IQ 8.x, 7.x, and 6.x are vulnerable to cross-site request forgery CSRF attacks through iControl SOAP. Note: Software versions...