Fedora 37 : grpc (2023-6cad6e5003)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6cad6e5003 advisory. Security fix for CVE-2023-32732 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Malicious code in puppeteer-kibana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71d9107e3aa60e76e79bc81d61da3e8f02cbb8805c5f5d616addaf90b65584fe The OpenSSF Package Analysis project identified 'puppeteer-kibana' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

CVE-2023-38408

A vulnerability was found in OpenSSH. The PKCS11 feature in the ssh-agent in OpenSSH has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system the code in /usr/lib is not necessarily safe for loading into ssh-agent...

Amazon Linux 2 : mc (ALAS-2023-2147)

The version of mc installed on the remote host is prior to 4.8.29-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2147 advisory. An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is...

PT-2025-41117

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth subsystem of the Linux kernel. In the hci cs disconnect function, the system calls hci conn del even if the disconnection process fails...

Medium: mc

Issue Overview: An issue was discovered in Midnight Commander through 4.8.26. When establishing an SFTP connection, the fingerprint of the server is neither checked nor displayed. As a result, a user connects to the server without the ability to verify its authenticity. CVE-2021-36370 Affected...

Tree connection race condition remote code execution vulnerability

...

Information Disclosure

Jenkins Active Directory Plugin is vulnerable to Information Disclosure. The vulnerability exists when it ignores the "Require TLS" and "StartTls" options and performs connection test without unencrypted which allows an attacker to gain access to sensitive information in the system...

CVE-2023-38434

xHTTP 72f812d has a double free in closeconnection in xhttp.c via a malformed HTTP request method...

DEBIAN-CVE-2023-38429

An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c in ksmbd has an off-by-one error in memory allocation because of ksmbdsmb2checkmessage that may lead to out-of-bounds access...

Postgraas SQL注入漏洞

Blue Yonder GmbH Postgraas is a super-simple PostgreSQL-as-a-service from Blue Yonder GmbH, China. A SQL injection vulnerability exists in Blue Yonder postgraasserver 2.0.0b2 and earlier versions, which originates from the function in the file...

PT-2023-4726 · Plk-100 · Plk-100

Name of the Vulnerable Software and Affected Versions: PLK-100 affected versions not specified Description: The issue is related to errors in TCP connection processing. It may allow a remote attacker to cause a denial of service. Recommendations: At the moment, there is no information about a new...

Code injection

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection...

CVE-2023-3615 Lack of server certificate validation in websockets connection

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection...

CVE-2023-3615 Lack of server certificate validation in websockets connection

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection...

CVE-2023-38431

An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connection.c in ksmbd does not validate the relationship between the NetBIOS header's length field and the SMB header sizes, via pdusize in ksmbdconnhandlerloop, leading to an out-of-bounds read...

Oracle Linux 8 : firefox (ELSA-2023-4076)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-4076 advisory. 102.13.0-2.0.1 - Updated homepages to use https Orabug: 34648274 - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the...

PT-2023-25456 · Mattermost · Mattermost Ios App

Name of the Vulnerable Software and Affected Versions: Mattermost iOS app affected versions not specified Description: The Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection, allowing a network attacker to intercept the WebSockets connection...

Oracle Linux 8 : thunderbird (ELSA-2023-4063)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-4063 advisory. 102.13.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 102.13.0-2 - Update to 102.13.0 build2 102.13.0-...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-67075)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...