ghostscript: buffer overflow in base/sbcp.c leading to data corruption

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then...

Rocky Linux 8 : 389-ds:1.4 (RLSA-2021:3079)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:3079 advisory. - A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any passwor...

Fedora 37 : firefox (2023-45b3c1d9ed)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-45b3c1d9ed advisory. - Updated to latest upstream 113.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

Security Bulletin: IBM Event Streams is affected by a vulnerability in a component (Apache Avro Java SDK)

Summary avro is used by IBM Event Streams as part of dependencies under Java CVE-2023-39410. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:...

Rocky Linux 8 : 389-ds:1.4 (RLSA-2022:0889)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:0889 advisory. - A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests,...

PT-2023-10638 · Unknown · Magnesium-Php

Name of the Vulnerable Software and Affected Versions: Magnesium-PHP versions up to 0.3.0 Description: A vulnerability was found in Magnesium-PHP, classified as problematic. The issue affects the formatEmailString function of the file src/Magnesium/Message/Base.php. The manipulation of the...

Security Bulletin: IBM® Db2® is vulnerable to an information disclosure vulnerability due to the consumed GSKit library (CVE-2023-32342)

Summary IBM® Db2® is vulnerable to an information disclosure vulnerability due to the consumed GSKit library. The fix for this issue was already published in an earlier bulletin. If you have already applied the appropriate Db2 special build or installed GSKit version 8.0.55.31, which contains the...

CVE-2023-41357 Galaxy Software Services Vitals ESP - Arbitrary File Upload

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...

CVE-2023-41357 Galaxy Software Services Vitals ESP - Arbitrary File Upload

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...

CVSS v4 Is Now Live and What You Need To Know About It

On November 1st, 2023, the Common Vulnerability Scoring System version 4 CVSS v4 was officially launched in General Availability GA following a period of public preview and feedback collection. This launch was orchestrated by the Forum of Incident Response and Security Teams FIRST, marking a...

Security Bulletin: IBM Storage Ceph is vulnerable via Exposure of Sensitive Information to an Unauthorized Actork in Golang (CVE-2022-32148)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-32148 Vulnerability Details CVEID: CVE-2022-32148 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by improper exposure of client IP addresses in net/htt...

Security Bulletin: "Unrestricted Internet Access/Outbound Connections" affects IBM CICS TX Standard and IBM CICS TX Advanced

Summary "Unrestricted Internet Access/Outbound Connections" affects IBM CICS TX Standard and IBM CICS TX Advanced. IBM CICS TX Standard and IBM CICS TX Advanced have addressed the applicable vulnerability. Vulnerability Details CVEID: CVE-2023-43018 DESCRIPTION: IBM CICS TX performs an operation ...

Security Bulletin: "Cross Site Request Forgery" affects IBM CICS TX Advanced and IBM CICS TX Standard

Summary "Cross Site Request Forgery" affects IBM CICS TX Advanced and IBM CICS TX Standard. IBM CICS TX Advanced and IBM CICS TX Standard have addressed the applicable vulnerability. Vulnerability Details CVEID: CVE-2023-42027 DESCRIPTION: IBM CICS TX is vulnerable to cross-site request forgery...

SUSE CVE-2021-3480

A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability...

VMware Workspace ONE UEM console updates address an open redirect vulnerability (CVE-2023-20886)

3. Advisory Details VMware Workspace ONE UEM console contains an open redirect vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8...

Fedora: Security Advisory for golang (FEDORA-2023-4bf641255e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

homeassistant-stubs (2022.8.7), mqtt-hass-base (>=4.0.0, <=4.0.7) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.8.7)

homeassistant PYPI version 2022.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.8.7 - mqtt-hass-base =4.0.0, =4.0.7 - pytest-homeassistant-custom-component 0.11.12 Source cves:...

homeassistant-stubs (2022.9.6), mqtt-hass-base (>=4.0.9, <=4.0.10) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.9.6)

homeassistant PYPI version 2022.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.9.6 - mqtt-hass-base =4.0.9, =4.0.10 - pytest-homeassistant-custom-component 0.11.25 Source cves:...

homeassistant-stubs (2022.10.2), mqtt-hass-base (4.0.14) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.10.2)

homeassistant PYPI version 2022.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.10.2 - mqtt-hass-base 4.0.14 - pytest-homeassistant-custom-component 0.12.7 Source cves: CVE-2023-41893...

homeassistant-stubs (2022.11.5), hydroqc2mqtt (>=0.5.0, <=0.6.1) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.11.5)

homeassistant PYPI version 2022.11.5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.5 - hydroqc2mqtt =0.5.0, =0.6.1 - mqtt-hass-base 4.1.1 Source cves: CVE-2023-41893 Source advisory:...