CVE-2022-1970

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority for the following reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to...

GHSA-R7V4-JWX9-WX43 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator

Background CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers IdP, focused primarily on educational and research institutions such as Universities. More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are al...

CVE-2021-42887

creationtimestamp| type| source ---|---|--- 2022-06-03 16:26:30+00:00| seen| https://t.me/cibsecurity/43814 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-42887.yaml...

Security Bulletin: IBM Telco Network Cloud Manager - Performance is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44832,CVE-2022-23302 and CVE-2022-23305)

Summary Apache Log4j is used by IBM Telco Network Cloud Manager - Performance for logging and is vulnerable to arbitrary code execution due to Apache Log4j CVE-2021-44832,CVE-2022-23302 and CVE-2022-23305. The fix includes Apache Log4j v2.17.1. Vulnerability Details CVEID: CVE-2021-44832...

Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2022-0391)

Summary IBM Security SOAR uses an older version of Python 3.6 that may be identified and exploited. An update has been released which addresses these issues. The version of Python included in the latest version of IBM ® Security Soar is 3.8. Vulnerability Details CVEID:CVE-2022-0391 DESCRIPTION:...

Fedora: Security Advisory for kernel-tools (FEDORA-2022-b2cde267d9)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: kernel-tools-5.17.11-100.fc34

This package contains the tools/ directory from the kernel source and the supporting documentation...

[SECURITY] Fedora 35 Update: kernel-tools-5.17.11-200.fc35

This package contains the tools/ directory from the kernel source and the supporting documentation...

[SECURITY] Fedora 36 Update: kernel-tools-5.17.11-300.fc36

This package contains the tools/ directory from the kernel source and the supporting documentation...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote attack due to Moment.js CVE-2022-24785

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote attack due to Moment.js CVE-2022-24785 with details below Vulnerability Details CVEID:CVE-2022-24785 DESCRIPTION: Moment.js could allow a remote attacker to traverse directories on the system, caused by improper...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to code injection due to CVE-2022-21803

Summary Node.js module nconf is used by IBM App Connect Enterprise Certified Container operands for loading default configuration values. IBM App Connect Enterprise Certified Container IntegrationServer, Dashboard and Designer operands may be vulnerable to code injection if the configuration file...

Security Bulletin: IBM App Connect Enterprise Certified Container Operator and IntegrationServer operands may be vulnerable to denial of service due to CVE-2021-39293

Summary IBM App Connect Enterprise Certified Container Operator and IntegrationServer operands may be vulnerable to denial of service if forced to process a malicious archive stream. This bulletin provides patch information to address the reported vulnerability CVE-2021-39293. Vulnerability Detai...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Xerces

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Xerces. Vulnerability Details CVEID: CVE-2022-23437 DESCRIPTION: Apache Xerces2 Java XML Parser is vulnerable to a denial of service, caused by an infinite loop in the XML parser. By persuading a victi...

qemu security update

15:4.2.1-17.el7 - arm/acpi: fix an out of spec UID for PCI root Michael S. Tsirkin - arm/acpi: fix duplicated UID of PCI interrupt link devices Heyi Guo - arm/acpi: fix PCI PRT definition Heyi Guo - docs: fix references to docs/devel/atomics.rst Stefano Garzarella Orabug: 33659123 - rcu: do not...

Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes. Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary...

Missing SSH host key validation in Jenkins Amazon EC2 Plugin

Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Jenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing...

GHSA-Q8QQ-2P5P-RG44 Missing SSH host key validation in Jenkins Amazon EC2 Plugin

Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents. Jenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the projdoceditpage.php Project Documentation feature. An attacker can execute arbitrary code after uploading an attachment with a crafted filename. The code is...

Pivotal Spring Framework contains unsafe Java deserialization methods

Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution RCE issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. Maintainers recommend...

GHSA-MQR8-3V8J-46WV Missing Authorization in Jenkins Configuration as Code Plugin

Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins...