389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in logentryattr...

CVE-2024-28864

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded wit...

CVE-2024-28864 [TagAwareCipher] - Decryption Failure (Regex Match)

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded wit...

com.auth0:spring-security-auth0 (0.2), com.brienwheeler.web:web-spring-security (>=1.0-release, <=1.11) +48 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.2.4.release)

org.springframework.security:spring-security-core MAVEN version 3.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.auth0:spring-security-auth0 0.2 -...

Debian: Security Advisory (DLA-3763-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in Open JDK affecting Rational Functional Tester / DevOps Test UI

Summary There are multiple vulnerabilities in Open JDK Version 8, OpenJ9 used by Rational Functional Tester RFT / DevOps Test UI. RFT has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2024-20952 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security componen...

qt:qtbase_gui_text_qtextdocument_setmarkdown: Heap-buffer-overflow in QUtf8::convertFromUnicode

Detailed Report: https://oss-fuzz.com/testcase?key=5182328190074880 Project: qt Fuzzing Engine: libFuzzer Fuzz Target: qtbaseguitextqtextdocumentsetmarkdown Job Type: libfuzzerasanqt Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x6040000009b2 Crash State:...

Security Bulletin: z/Transaction Processing Facility is affected by an OpenSSL vulnerability

Summary The z/TPF version of OpenSSL was updated to address the vulnerability described by CVE-2024-0727. Vulnerability Details CVEID:CVE-2024-0727 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to open a specially crafted...

OSV-2024-171 Security exception in org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67357 Crash type: Security exception Crash state: org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parse java.base/sun.util.calendar.ZoneInfo.getLastRawOffset java.base/sun.util.calendar.ZoneInfo.getOffse...

Security Bulletin: AIX is vulnerable to a machine-in-the-middle attack (CVE-2023-48795), arbitrary command execution (CVE-2023-51385), and information disclosure (CVE-2023-51384) due to OpenSSH

Summary Vulnerabilities in AIX's OpenSSH could allow a remote attacker to launch a machine-in-the-middle attack CVE-2023-48795 and execute arbitrary commands CVE-2023-51385, and could allow a local authenticated attacker to obtain sensitive information CVE-2023-51384. OpenSSH is used by AIX for...

PT-2024-40659 · Unknown · Generatedjavaparser

Name of the Vulnerable Software and Affected Versions: GeneratedJavaParser affected versions not specified Description: A security exception crash has been reported. The crash involves the com.github.javaparser.GeneratedJavaParser.Expression class, the java.base/java.lang.String.startsWith method...

Malicious code in fhir.base.template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d390c24638a730f4667334b430b5a02e28305f199a61a609e88c28c3dd5f5b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Multiple CVEs - Vulnerabilities in IBM Java Runtime affect IBM Integration Designer

Summary Vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by IBM Integration Designer. IBM Integration Designer has addressed the following CVEs. Vulnerability Details CVEID:CVE-2024-20952 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could...

CVE-2024-0800

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

Path traversal

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

CVE-2024-0800 Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

CVE-2024-0800: Unrestricted Upload of File with Dangerous Type

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

CVE-2024-0799: Improper Authentication

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin function within wizardLogin...

SUSE SLES15: libpython3_6m1_0 / python3 / python3-base / python3-curses / etc (SUSE-SU-2024:0850-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0850-1 advisory. - CVE-2023-6597: Fixed symlink bug in cleanup of tempfile.TemporaryDirectory bsc1219666. Tenable has extracted the preceding description blo...

2024-03 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems (KB5035857)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...