Security Bulletin: Multiple vulnerabilities identified in jQuery-UI affects IBM Engineering Lifecycle Optimization - Publishing

Summary This Security Bulletin addresses security vulnerabilities with JQuery that have been remediated in latest iFixes of IBM Engineering Lifecycle Optimization - Publishing Vulnerability Details CVEID:CVE-2021-41184 DESCRIPTION: jQuery jQuery-UI is vulnerable to cross-site scripting, caused by...

NSA AI Security Center

The NSA is starting a new artificial intelligence security center: The AI security centers establishment follows an NSA study that identified securing AI models from theft and sabotage as a major national security challenge, especially as generative AI technologies emerge with immense...

SUSE: Security Advisory (SUSE-SU-2023:3801-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: gstreamer-plugins-base / gstreamer-plugins-base-devel / etc (SUSE-SU-2023:3801-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3801-1 advisory. - CVE-2023-37327: Fixed FLAC file parsing integer overflow bsc1213128. - CVE-2023-37328: Fixed PGS file parsing...

open-vm-tools security update

An update is available for open-vm-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Open Virtual Machine Tools are the open source implementation of th...

ipa bug fix update

An update is available for custodia, module.custodia, pyusb, python-qrcode, module.slapi-nis, module.pyusb, module.softhsm, python-jwcrypto, python-kdcproxy, module.opendnssec, module.python-kdcproxy, module.ipa, ipa-healthcheck, softhsm, module.python-jwcrypto, ipa, opendnssec, python-yubico,...

389-ds:1.4 bug fix update

An update is available for 389-ds-base, module.389-ds-base. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list 389 Directory Server is an LDAP version 3 LDAPv3...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to OS command injection (CVE-2022-35717)

Summary An OS command injection vulnerability in InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2022-35717 DESCRIPTION: IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a...

asyncio-gevent (0.2.1), bgpfu (>=0.2.0, <=0.3.0) +82 more potentially affected by CVE-2023-41419 via gevent (21.12.0)

gevent PYPI version 21.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on gevent and may be impacted: - asyncio-gevent 0.2.1 - bgpfu =0.2.0, =1.0.0, =0.0.1, =0.0.2a0, =0.1.10, =0.7.2, =0.1.0, =0.5.0, =0.0.1, =0.0.10, =3.23.1, =3.24.1 and more Source...

canonicalwebteam-flask-base (0.6.3) potentially affected by CVE-2023-41419 via gevent (20.6.1)

gevent PYPI version 20.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on gevent and may be impacted: - canonicalwebteam-flask-base 0.6.3 Source cves: CVE-2023-41419 Source advisory: OSV:GHSA-X7M3-JPRG-WC5G...

backwardcompatibilityml (>=1.0.0, <=1.4.2), canonicalwebteam-flask-base (>=0.6.4, <=0.9.0) +11 more potentially affected by CVE-2023-41419 via gevent (20.6.2)

gevent PYPI version 20.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on gevent and may be impacted: - backwardcompatibilityml =1.0.0, =0.6.4, =0.1.0, =1.1.0, =0.0.1, =1.0.2rc0, =0.11.0, =0.2.0, =0.0.3, =0.0.4 Source cves: CVE-2023-41419 Source...

canonicalwebteam-flask-base (0.6.3) potentially affected by CVE-2023-41419 via gevent (20.6.1)

gevent PYPI version 20.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on gevent and may be impacted: - canonicalwebteam-flask-base 0.6.3 Source cves: CVE-2023-41419 Source advisory: OSV:PYSEC-2023-177...

asyncio-gevent (0.2.1), bgpfu (>=0.2.0, <=0.3.0) +82 more potentially affected by CVE-2023-41419 via gevent (21.12.0)

gevent PYPI version 21.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on gevent and may be impacted: - asyncio-gevent 0.2.1 - bgpfu =0.2.0, =1.0.0, =0.0.1, =0.0.2a0, =0.1.10, =0.7.2, =0.1.0, =0.5.0, =0.0.1, =0.0.10, =3.23.1, =3.24.1 and more Source...

Important: firefox

Issue Overview: Integer overflow vulnerability in avtimecodemakestring in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service DoS via crafted .mov file. CVE-2021-28429 A vulnerability was found in expat. With this flaw, it is possible to create a...

CVE-2023-22024

In the Unbreakable Enterprise Kernel UEK, the RDS module in UEK has two setsockopt2 options, RDSCONNRESET and RDS6CONNRESET, that are not re-entrant. A malicious local user with CAPNETADMIN can use this to crash the kernel. CVSS 3.1 Base Score 5.5 Availability impacts. CVSS Vector:...

CVE-2023-36109

Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecmastringbuilderappendraw component at /jerry-core/ecma/base/ecma-helpers-string.c...

Advisory ROSA-SA-2023-2237

SOFTWARE: 389-ds-base 1.4.4.4.4. WASP: ROSA-CHROME packageevrstring: 389-ds-base-1.4.4.4-12.src.rpm CVE-ID: CVE-2021-3652 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: An error has been detected in 389-ds-base. If the asterisk is imported as password hashes either accidentally or maliciously, then...

ROS-20230915-11

A vulnerability in the Base plugin gst-plugins-base of the Gstreamer multimedia framework is related to a buffer overrun during the parsing and decoding of subtitles from SRT files. operation outside the memory buffer when parsing and decoding subtitles from SRT files. Exploitation exploitation o...

CVE-2023-40955

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the select parameter in models/baseclient.py componen...

CVE-2023-40955

A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management aka pdm v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 allows a remote authenticated attacker to execute arbitrary code via the select parameter in models/baseclient.py componen...