CVE-2024-10218

TIBCO Hawk and TIBCO Operational Intelligence (MAR Utility) are affected by CVE-2024-10218 due to a stored-XEE/XSS vulnerability in mar.jar and monitoringconsolecommon.jar. The issue could allow an attacker to read sensitive files on the host with the server’s privileges. Affected products/versio...

CVE-2024-10218 TIBCO Hawk Stored-XEE Vulnerability

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

CVE-2024-10217

CVE-2024-10217 describes a stored XSS vulnerability in TIBCO Hawk and TIBCO Operational Intelligence, specifically in mar.jar (Monitoring Archive Utility) and monitoringconsolecommon.jar. The advisory details that a malicious .mar file could trigger XSS, potentially allowing an attacker to execut...

CVE-2024-10217 TIBCO Hawk Stored-XSS Vulnerability

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

TIBCO Security Advisory: November 12, 2024 - TIBCO Hawk & Operational Intelligence - CVE-2024-10217

TIBCO Hawk Stored-XSS Vulnerability Original release date: November 12, 2024 Last revised: --- CVE-2024-10217 Source: TIBCO Software Inc. Products Affected TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, and 6.3.0 TIBCO Operational Intelligence Hawk versions 7.2.0, 7.2.1, and 7.2.2 Compone...

python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service

A flaw was found in Python's zipfile module. When iterating over the entries of a zip archive, the process can enter into an infinite loop state and become unresponsive. This flaw allows an attacker to craft a malicious ZIP archive, leading to a denial of service from the application consuming th...

Security update for pcp

This update for pcp fixes the following issues: pcp was updated from version 3.11.9 to version 6.2.0 jscPED-8192, jscPED-8389: Security issues fixed: CVE-2024-45770: Fixed a symlink attack that allows escalating from the pcp to the root user bsc1230552 CVE-2024-45769: Fixed a heap corruption...

PT-2024-16122 · Tibco Software · Tibco Operational Intelligence +1

Name of the Vulnerable Software and Affected Versions: TIBCO Hawk and TIBCO Operational Intelligence affected versions not specified Description: A high-severity issue exists in TIBCO Software Inc. products, specifically in the Monitoring Archive Utility MAR Utility, affecting multiple jar files,...

ALSA-2024:9115 Moderate: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang: net: malformed DNS message can cause infinite loop CVE-2024-24788 golang: archive/zip: Incorrect handling of certain ZIP files CVE-2024-24789 golang: net/netip:...

Malicious code in modlog-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3bc2d1d981039b25af543c99dcd5081c70b24b7ee9c3eb7d68b3c96003bd4a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10575 Malicious code in modlog-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3bc2d1d981039b25af543c99dcd5081c70b24b7ee9c3eb7d68b3c96003bd4a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Ubuntu: Security Advisory (USN-7096-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dsa-5806 : libarchive-dev - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5806 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5806-1 [email protected] https://www.debian.org/security/...

Security update for libarchive

This update for libarchive fixes the following issues: CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability bsc1225972. CVE-2024-48958: Fixed out-of-bounds access via a crafted archive file in executefilterdelta function bsc1231624. Patch Instructions: To install this SUSE upda...

SUSE-SU-2024:3940-1 Security update for libarchive

This update for libarchive fixes the following issues: - CVE-2024-20697: Fixed Out of bounds Remote Code Execution Vulnerability bsc1225972. - CVE-2024-48958: Fixed out-of-bounds access via a crafted archive file in executefilterdelta function bsc1231624...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gradle (SUSE-SU-2024:3923-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:3923-1 advisory. - CVE-2023-35947: Fixed an issue while unpacking tar archives, where files could be created outside of th...

MGASA-2024-0346 Updated libarchive packages fix security vulnerabilities

executefilteraudio in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst. CVE-2024-48957 executefilterdelta in archivereadsupportformatrar.c in libarchive before 3.7.5 allows out-of-bounds access via a...

SUSE-SU-2024:3923-1 Security update for gradle

This update for gradle fixes the following issues: - CVE-2023-35947: Fixed an issue while unpacking tar archives, where files could be created outside of the unpack location bsc1212931...

python: cpython: tarfile: ReDos via excessive backtracking while parsing header values

A regular expression denial of service ReDos vulnerability was found in Python's tarfile module. Due to excessive backtracking while tarfile parses headers, an attacker may be able to trigger a denial of service via a specially crafted tar archive...

Safearchive Path Traversal vulnerability

There exists a Path Traversal vulnerability in Safearchive on Platforms with Case-Insensitive Filesystems e.g., NTFS. This allows Attackers to Write Arbitrary Files via Archive Extraction containing symbolic links. We recommend upgrading past commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc...