org.apache.kylin:kylin-tool-assembly (3.0.2) potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-server-base (3.0.2)

org.apache.kylin:kylin-server-base MAVEN version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 3.0.2 Source cves: CVE-2022-24697 Source advisory:...

org.apache.kylin:kylin-tool-assembly (2.6.1) potentially affected by CVE-2022-24697 via org.apache.kylin:kylin-server-base (2.6.1)

org.apache.kylin:kylin-server-base MAVEN version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kylin:kylin-server-base and may be impacted: - org.apache.kylin:kylin-tool-assembly 2.6.1 Source cves: CVE-2022-24697 Source advisory:...

Security Bulletin: Watson CP4D Data Stores is vulnerable to unspecified vulnerability Golang Go (CCVE-2022-23773)

Summary Potential Golang Go unspecified vulnerability CVE-2022-237732 has been identified that may affect Watson CP4D Data Stores Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with...

Security Bulletin: IBM DataPower Gateway potentially vulnerable to Denial of Service (CVE-2023-2650)

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using OBJobj2txt directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit. By sendin...

PT-2023-25718 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry versions 23.6.0 through 23.6.1 Description: Sentry is an error tracking and performance monitoring platform. The Sentry API incorrectly returns the access-control-allow-credentials: true HTTP header if the Origin request header ends wi...

Mobileiron Sentry security vulnerabilities

Mobileiron Sentry is a Smart Gateway product from Mobileiron, Inc. A security vulnerability exists in Sentry versions 23.6.0 through 23.6.2 and earlier, which stems from the Sentry API returning an incorrect HTTP header if the request header ends in system.base-hostname...

SUSE SLED15: libQt6Concurrent6 / libQt6Core6 / libQt6DBus6 / libQt6Gui6 / etc (SUSE-SU-2023:2780-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2780-1 advisory. - CVE-2023-32763: Fixed an overflow in QTextLayout bsc1211798. Tenable has extracted the preceding...

SUSE-SU-2023:2780-1 Security update for qt6-base

This update for qt6-base fixes the following issues: - CVE-2023-32763: Fixed an overflow in QTextLayout bsc1211798...

Huawei EulerOS: Security Advisory for harfbuzz (EulerOS-SA-2023-2294)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Veeam Backup for Cloud Solutions Potential Data Loss

Challenge If, between the runs of a backup policy for a VM, a virtual disk is removed and added back to that same VM, data blocks belonging to that disk may be deleted from the backups during the retention process. This can lead to a data loss scenario. Impacted Product Versions: Veeam Plug-In fo...

PT-2023-36410 · Gnu +1 · Debian +1

Уязвимость плагина Base gst-plugins-base мультимедийного фреймворка Gstreamer связана с недостаточной защитой служебных данных в результате отсутствия на удаленном хосте обновлений безопасности. Эксплуатация уязвимости может позволить нарушителю получить несанкционированный доступ к защищаемой...

Security Bulletin: A security vulnerability has been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component (CVE-2022-3676)

Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerability. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type chec...

WordPress Easy Accordion FAQ and Knowledge Base Software for WordPress Plugin <= 2.7 is vulnerable to Cross Site Scripting (XSS)

Software Easy Accordion FAQ and Knowledge Base Software for WordPress Type Plugin Vulnerable versions = 2.7 Fixed in 2.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID d0f6976b048f...

8Base Ransomware Spikes in Activity, Threatens U.S. and Brazilian Businesses

A ransomware threat called 8Base that has been operating under the radar for over a year has been attributed to a "massive spike in activity" in May and June 2023. "The group utilizes encryption paired with 'name-and-shame' techniques to compel their victims to pay their ransoms," VMware Carbon...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Process Mining . Multiple CVEs

Summary There is a vulnerability in Apache Tomcat that could allow a remote attacker to bypass security restrictions and obtain sensitive information, The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Security Bulletin: Vulnerability in Spring Security affects IBM Process Mining . Multiple CVEs

Summary There is a vulnerability in Spring Security that could allow a local authenticated attacker launch further attacks on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Arbitrary File Upload

jeecg-boot-base-core is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate uploading files, allowing an attacker to upload maliciously crafted files through the /jeecg-boot/jmreport/upload endpoint...

Security Bulletin: IBM Spectrum Control is vulnerable to weakness related to Node.js

Summary Vulnerability in Node.js allow a denial of service, caused by a regular expression may affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2023-24807 DESCRIPTION: Node.js is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the...

PHPJabbers Knowledge Base Builder 3.0 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new`

The function ChunkId::new creates a misaligned pointer by casting mutable pointer of u8 slice which has alignment 1 to the mutable pointer of u32 which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function...