Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2023-12232)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12232 advisory. - netfilter: nftables: fix null deref due to zeroed list head Florian Westphal Orabug: 35181628 CVE-2023-1095 - sctp: fail if no bound addresses c...

Rocket Software UniData 和 UniVerse 缓冲区错误漏洞

Rocket Software UniVerse and Rocket Software UniData are both products of Rocket Software, Inc. Rocket Software UniVerse is a suite of database management and support software now owned by Rocket Software. Software UniData is a MultiValue application platform. Rocket Software UniData is a...

ABB Multiple System 800xA Products Incorrect Default Permissions (CVE-2020-8484)

Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash. This plugin only works wi...

CVE-2022-36060

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

CVE-2022-36060

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

CVE-2022-36060 Prototype pollution in matrix-react-sdk

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

USN-5981-1 linux-aws-hwe, linux-hwe, linux-oracle vulnerabilities

It was discovered that the System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service memory exhaustion. CVE-2021-3669 It was discovered that a use-after-free vulnerability existed in the SGI GRU...

The vulnerability of the ANGLE library in Google Chrome browsers allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the ANGLE library in Google Chrome browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause service failures or execute arbitrary code through a specially created HTML page...

CVE-2023-0210

A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems...

RHEL 8 : firefox (RHSA-2023:1367)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1367 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

Medium: nginx

Issue Overview: ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can...

OracleVM 3.4 : xen (OVMSA-2023-0005)

The remote OracleVM system is missing necessary patches to address security updates: - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a...

Medium: dbus

Issue Overview: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. CVE-2022-42010 An...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2023-064)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-064 advisory. A flaw was found in the Redis database where Lua scripts can be manipulated to overcome ACL rules. This flaw allows an attacker with access to Redis to inject Lua code that executes the...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2023-12206)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12206 advisory. - ipv6: raw: Deduct extension header length in rawv6pushpendingframes Herbert Xu Orabug: 35005829 CVE-2023-0394 - net: sched: disallow noqueue for...

Design/Logic Flaw

kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and...

Oracle Linux 8 : firefox (ELSA-2023-1336)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-1336 advisory. 102.9.0-3.0.1 - Updated homepages to use https Orabug: 34648274 - Removed Upstream references - Add firefox-oracle-default-prefs.js and remove the...

RHEL 8 : firefox (RHSA-2023:1336)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1336 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...

CBL Mariner 2.0 Security Update: uclibc-ng (CVE-2021-43523)

The version of uclibc-ng installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43523 advisory. - In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned ...

The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird involve errors during the import of the SPKI RSA public key as an ECDSA P-256. These vulnerabilities allow attackers to cause crashes in the browser tabs.

The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the Mozilla Thunderbird email client are related to errors during the import of the SPKI RSA public key as an ECDSA P-256. Exploiting these vulnerabilities can allow a remote attacker to cause failures in the browser tabs...