libgcrypt security update

1.8.5-6fips - Add API to provide hash calculation in RSA/DSA/ECDSA signature operations Orabug: 33081130 - Change Epoch from 1 to 10 1.8.5-6 - Fix for CVE-2021-33560 1971421 - Enable HW optimizations in FIPS 1976137 - Performance enchancements for ChaCha20 and Poly1305 1855231 1.8.5-5 - Performan...

Debian: Security Advisory (DSA-5112-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5111-1 : zlib - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5111 advisory. - zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches. CVE-2018-25032 Note that Nessus has not...

Debian: Security Advisory (DSA-5108-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-5108-1 : tiff - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5108 advisory. Multiple vulnerabilities have been discovered in the libtiff library and the included tools, which may result in denial of service if malformed image files a...

Debian: Security Advisory (DSA-5105-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-5104-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GSD-2022-1000698 net: dsa: microchip: fix bridging with more than two member ports

net: dsa: microchip: fix bridging with more than two member ports This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.13 by commit...

CVE-2022-23610 Improper Verification of Cryptographic Signature in wire-server

wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without SCIM, it was...

Debian DSA-5103-1 : openssl - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5103 advisory. Tavis Ormandy discovered that the BNmodsqrt function of OpenSSL could be tricked into an infinite loop. This could result in denial of service via malformed...

Debian DSA-5100-1 : nbd - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5100 advisory. - In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field...

Debian DSA-5101-1 : libphp-adodb - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5101 advisory. Emmet Leahy reported that libphp-adodb, a PHP database abstraction layer library, allows to inject values into a PostgreSQL connection string. Depending on how the...

Debian DSA-5098-1 : tryton-server - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5098 advisory. - An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton...

CVE-2021-42854

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA PluginServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/plugin/pmx" API. The affected endpoint does not have any input validation of the user's input that allows a malicious payload to be...

CVE-2021-42853

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA AgentDiagnosticServlet has directory traversal vulnerability at the "/api/appInternals/1.0/agent/diagnostic/logs" API. The affected endpoint does not have any input validation of the user's input that allows a...

Debian: Security Advisory (DSA-5096-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-42854

The CVE-2021-42854 issue affects SteelCentral AppInternals, specifically the Dynamic Sampling Agent’s PluginServlet. The vulnerability arises from lack of input validation at the /api/appInternals/1.0/plugin/pmx endpoint, enabling directory traversal and potential injection of malicious loads. Pu...

CVE-2021-42787

The CVE-2021-42787 entry concerns the SteelCentral AppInternals Dynamic Sampling Agent (DSA) AgentConfigurationServlet. The vulnerability is a directory traversal flaw in the API endpoint /api/appInternals/1.0/agent/configuration, caused by lack of input validation on user input, which could enab...

CVE-2021-42857

The CVE-2021-42857 issue affects SteelCentral AppInternals Dynamic Sampling Agent (DSA) – AgentDaServlet. Affected component: the API at /api/appInternals/1.0/agent/da/pcf. Root cause: input in this endpoint is not validated, enabling directory traversal and potential injection of malicious paylo...

CVE-2021-42857 Directory Traversal Partial Write at AgentDaServlet

It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent's DSA AgentDaServlet has directory traversal vulnerabilities at the "/api/appInternals/1.0/agent/da/pcf" API. The affected endpoint does not have any validation of the user's input that allows a malicious payload to be...