Debian dla-3388 : keepalived - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3388 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3388-1 [email protected] https://www.debian.org/lts/security/...

SUSE CVE-2022-3787

A vulnerability was found in the device-mapper-multipath. The device-mapper-multipath allows local users to obtain root access, exploited alone or in conjunction with CVE-2022-41973. Local users that are able to write to UNIX domain sockets can bypass access controls and manipulate the multipath...

Tenable SecurityCenter 5.22 - 6.0.0 Access Control Bypass (TNS-2023-17)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is running 5.22 to 6.0.0 and is therefore affected by an Apache vulnerability which could result in bypassing of access controls. C Tenable Network Security, Inc...

Access Control Bypass

Overview magento/project-community-edition is an eCommerce Platform for Growth Community Edition Affected versions of this package are vulnerable to Access Control Bypass due to improper handling of access controls. An attacker can bypass security features and impact the availability of a user's...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass due to improper handling of access controls. An attacker can bypass security features and impact the availability of a user's minor feature without...

CVE-2023-21034

CVE-2023-21034 affects Android 13 devices, with the vulnerability located in multiple SensorService.cpp functions where a permissions bypass may allow access to accurate sensor data, causing local privilege escalation. The issue is described as needing low privileges and no user interaction, with...

Medium: gnupg2

Issue Overview: A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control. CVE-2022-34903 Affected Packages: gnupg2 Issue Correction: Run dnf update gnupg...

PT-2023-16994 · Unknown · Watchdog Anti-Virus

Name of the Vulnerable Software and Affected Versions: Watchdog Anti-Virus version 1.4.214.0 Description: A critical issue has been found, affecting the function in the library wsdk-driver.sys of the component IoControlCode Handler, leading to improper access controls. The manipulation requires a...

Symantec Endpoint Protection Client < 14.3 RU5 Security Control Bypass

The version of Symantec Endpoint Protection Client SEP installed on the remote host is prior to 14.3 RU5 Patch 1. It is therefore affected by a Security Control Bypass if Client User Interface Password protection and/or Policy Import/Export Password protection is enabled. CVE-2022-37017 Note that...

Information Disclosure

389-ds-base is vulnerable to Information Disclosure. The mishandling of a filter may lead to an access control bypass, allowing remote unauthenticated users to search for database items they do not have access to, such as userPassword hashes and other sensitive data...

Access Control Bypass

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Access Control Bypass due to the usage of a vulnerable dependency package libxslt, which allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWri...

Apache HTTP Server 环境问题漏洞

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable, and extensible via a simple API. An environmental issue vulnerability exists in Apache HTTP Server versions 2.4.0 through 2.4.55 that stems from certain modproxy...

Internet Bug Bounty: HTTP Request Smuggling Due to Incorrect Parsing of Header Fields

A vulnerability was discovered in the HTTP request parsing of Node.js version 18.7.0 that allowed header fields to be incorrectly handled without carriage return line feed termination, enabling potential HTTP request smuggling...

Fedora 36 : haproxy (2023-7e04833463)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-7e04833463 advisory. Security fix for CVE-2023-0056, CVE-2023-25725 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

CVE-2023-24093

An access control issue in H3C A210-G A210-GV100R005 allows attackers to authenticate without a password...

K44453423: IP-in-IP Packet Processing vulnerability CVE-2020-10136

Security Advisory Description Multiple products that implement the IP Encapsulation within IP standard RFC 2003, STD 1 decapsulate and route IP-in-IP traffic without any validation, which could allow an unauthenticated remote attacker to route arbitrary traffic via an exposed network interface an...

SUSE CVE-2004-2154

CUPS before 1.1.21rc1 treats a Location directive in cupsd.conf as case sensitive, which allows attackers to bypass intended ACLs via a printer name containing uppercase or lowercase letters that are different from what is specified in the directive...

SUSE CVE-2005-0241

The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size...

SUSE CVE-2008-7247

sql/sqltable.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, and 6.0 before 6.0.9-alpha, when the data home directory contains a symlink to a different filesystem, allows remote authenticated users to bypass intended access restrictions by calling CREATE TABLE with a 1 DATA DIRECTORY or 2...

SUSE CVE-2009-2476

The Java Management Extensions JMX implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged...