RHEL 7 : libwebp (RHSA-2023:2077)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2077 advisory. The libwebp packages provide a library and tools for the WebP graphics format. WebP is an image format with a lossy compression of digital photograph...

PT-2023-10825 · Drupal · Responsive Menu

Name of the Vulnerable Software and Affected Versions: Responsive Menus versions 7.x-1.x-dev through 7.x-1.6 Description: A vulnerability was found in the Responsive Menus module on Drupal, affecting the responsive menus admin form submit function of the responsive menus.module file. This issue...

[SECURITY] Fedora 38 Update: php-nyholm-psr7-1.7.0-1.fc38

A super lightweight PSR-7 implementation. Very strict and very fast.. Autoloader: /usr/share/php/Nyholm/Psr7/autoload.php...

Fedora: Security Advisory for php-laminas-diactoros2 (FEDORA-2023-8cf8786a16)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-30454

An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be...

[SECURITY] Fedora 38 Update: php-laminas-diactoros2-2.25.2-1.fc38

A PHP package containing implementations of the accepted PSR-7 HTTP message interfaces 1, as well as a "server" implementation similar to node's http.Server 2. Documentation: https://docs.laminas.dev/laminas-diactoros/ Autoloader: /usr/share/php/Laminas/Diactoros2/autoload.php 1...

[SECURITY] Fedora 37 Update: php-nyholm-psr7-1.6.1-1.fc37

A super lightweight PSR-7 implementation. Very strict and very fast.. Autoloader: /usr/share/php/Nyholm/Psr7/autoload.php...

SUSE: Security Advisory (SUSE-SU-2023:2048-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-G36H-4JR6-QMM9 Improper input validation in Drupal core

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...

GHSA-7JR4-HGQX-VWGQ Access bypass in Drupal core

Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting in some possible access bypass for users who have access to use revisions of content generally, but who do not have access to individual...

CVE-2022-25275

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...

SUSE: Security Advisory (SUSE-SU-2023:2000-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Siemens Multiple RTOS Integer Overflow or Wraparound (CVE-2020-35198)

An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc. As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption...

CVE-2022-25275

CVE-2022-25275 affects Drupal’s Image module, allowing access to non-public image files when generating derivatives if contributed file systems are used and insecure derivatives are enabled. The issue is mitigated by keeping $config['image.settings']['allow_insecure_derivatives'] (Drupal 9) or $c...

CVE-2022-25275

In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivative images using the image styles system. Access to a non-public file is checked only if it is stored in the "private" file system. However,...

kernel security and bug fix update

3.10.0-1160.90.1.0.1.OL7 - debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 3.10.0-1160.90.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 2481767...

CentOS: Security Advisory for java-11-openjdk (CESA-2023:1875)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 7 : kernel (ELSA-2023-1987)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-1987 advisory. - debug: lock down kgdb Orabug: 34270798 CVE-2022-21499 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

CentOS 7 : java-11-openjdk (RHSA-2023:1875)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1875 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affecte...

Oracle Linux 7 : java-1.8.0-openjdk (ELSA-2023-1904)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-1904 advisory. 1:1.8.0.372.b07-1 - Update to shenandoah-jdk8u372-b07 GA - Update release notes for shenandoah-8u372-b07. - Require tzdata 2023c due to inclusion of...