RHEL 7 : tigervnc (RHSA-2023:0045)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0045 advisory. Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine...

RHEL 7 : xorg-x11-server (RHSA-2023:0046)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0046 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical use...

Slackware Linux 15.0 / current mozilla-nss Vulnerability (SSA:2023-006-01)

The version of mozilla-nss installed on the remote host is prior to 3.87. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-006-01 advisory. - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded D...

Security Bulletin: An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Version 8 supplied by IBM MQ (CVE-2021-2163)

Summary An issue was identified with IBM® Runtime Environment Java™ Technology Edition, Versions 7 and 8 supplied by IBM MQ versions. The IBM® Runtime Environment Java™ Technology Edition, Version 8 is used for Java Client, JMS Client, AMQP, MQTT, Blockchain Bridge, Salesforce Bridge, Java AMS, M...

CVE-2022-44877

login/index.php in CWP aka Control Web Panel or CentOS Web Panel 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter...

CVE-2022-44877

login/index.php in CWP aka Control Web Panel or CentOS Web Panel 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter. Recent assessments: h00die-gr3y at January 14, 2023 6:25pm UTC reported: This vulnerability is all about...

CD MP3 Terminator V2.07 Local Seh Exploit

Exploit Title: CD MP3 Terminator V2.07 Local Seh Exploit Date: 31.12.2022 Vendor Homepage: http://www.cdmp3terminator.com Software Link: https://www.softpedia.com/dyn-postdownload.php/7a9b28e4e4800cd04331f2f3df26259a/63b031ec/7084/4/2 Exploit Author: Achilles Tested Version: 2.07 Tested on: Windo...

Raspberry Robin Worm Evolves to Attack Financial and Insurance Sectors in Europe

Financial and insurance sectors in Europe have been targeted by the Raspberry Robin worm, as the malware continues to evolve its post-exploitation capabilities while remaining under the radar. "What is unique about the malware is that it is heavily obfuscated and highly complex to statically...

SUSE: Security Advisory (SUSE-SU-2022:4641-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GoGo CD Ripper V1.4.9 Denial of Service Exploit

Exploit Title: GoGo CD Ripper V1.4.9 Denial of Service Exploit Date: 30.12.2022 Vendor Homepage:https://cd-mp3.org/ Software Link: https://download.cnet.com/Gogo-CD-To-MP3-Ripper/3001-21404-10330843.ht Exploit Author: Achilles Tested Version: v1.4.9 Tested on: Windows 7 x64 1.- Run python code...

AimOne Video Converter V2.04 Build 103 Denial of Service Exploit

Exploit Title: AimOne Video Converter V2.04 Build 103 Denial of Service Exploit Date: 30.12.2022 Vendor Homepage:www.aimonesoft.com Software Link: https://aimone-video-converter.software.informer.com/download/downloading Exploit Author: Achilles Tested Version: v2.04 Tested on: Windows 7 x64 1.-...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. Vulnerability Details CVEID:CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker...

CVE-2022-2509 affecting package gnutls 3.6.14-7

CVE-2022-2509 affecting package gnutls 3.6.14-7. A patched version of the package is available...

CVE-2022-47949

The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victim must join a game session with the attacker. Other affect...

Fedora 35 : drupal7-link (2022-74fe01686a)

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-74fe01686a advisory. - https://www.drupal.org/project/link/releases/7.x-1.11 - SA-CONTRIB-2022-034 - https://www.drupal.org/project/link/releases/7.x-1.10 -...

Images Optimize and Upload CF7 <= 2.1.4 - Unauthenticated Arbitrary File Deletion

The plugin does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack. 1. Install contact-form-7 dependency 2. Install the vulnerable plugin images-optimize-and-upload-cf7...

AZL-12083 CVE-2022-4515 affecting package ctags for versions less than 5.9.20220619.0-7

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags in sort.c calls the system3...

Authorization

Concourse 7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9 contains an authorization bypass issue. A Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team...

CVE-2022-31683

Concourse 7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9 contains an authorization bypass issue. A Concourse user can send a request with body including :teamname=team2 to bypass team scope check to gain access to certain resources belong to any other team...

RHEL 7 : thunderbird (RHSA-2022:9079)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:9079 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.6.0. Security Fixes: Mozilla:...