Security Bulletin: Multiple vulnerabilities in the werkzeug repo affect IBM Elastic Storage System

Summary There is a vulnerability in the werkzeug repo, used by IBM Elastic Storage System, which could allow a denial of service. Vulnerability Details CVEID:CVE-2023-25577 DESCRIPTION: Pallets Werkzeug is vulnerable to a denial of service, caused by a flaw when parsing multipart form data with...

Security Bulletin: Multiple Linux Kernel vulnerabilities may affect IBM Elastic Storage System

Summary There are some vulnerabilities in the Linux kernel, used by IBM Elastic Storage System, which could allow a denial of service. Fixes for these vulnerabilities are available. Vulnerability Details CVEID:CVE-2022-42703 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused b...

Some GPO's fail to apply when elastic layering is enabled

With Elastic Layering Apps Only enabled, gpupdate /force may report an error while applying some group policies...

Incorrect parameter for getCallerReward might return 0 reward despite insolvency

Lines of code Vulnerability details Impact The calculation of the caller reward uses an incorrect value. If the exchangeRate remains the same but a lot of interest accrues, then there will be no liquidation reward. Without a liquidation reward borrowing positions will not get liquidated and incur...

Malicious code in elastic-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbe3c8eb7407200d7e0976f17ba59d709e62dba4fc1291d71efa92c6761c466e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in elastic-internal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-1025 Malicious code in elastic-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbe3c8eb7407200d7e0976f17ba59d709e62dba4fc1291d71efa92c6761c466e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Elastic Email Sender Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)

Software Elastic Email Sender Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-38387 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9e6f7efb17d9 Credits yuyudhn Required...

Vulnerabilities fixed in Oracle Communications Applications

Vulnerabilities have been fixed in Oracle Communications Applications products. A malicious party could exploit them to carry out attacks that can result in the following categories of damage: Denial-of-Service DoS Manipulation of data Remote code execution Administrator/Root rights Remote code...

A Bootiful Podcast: Elastic's Philipp Krenn

Hi Spring fans! Welcome to another installment of a Bootiful Podcast! In this installment, Josh Long talks to Elastic's Philipp Krenn, live from Spring IO 2023 in beautiful Barcelona, Spain!...

AWS Cloud Development Kit 安全漏洞

AWS Cloud Development Kit is an open source software development framework for defining cloud infrastructure in code and configuring it via AWS CloudFormation. A security vulnerability exists in AWS Cloud Development Kit that stems from two roles created by eks.Cluster and eks.FargateCluster that...

Information Disclosure

github.com/elastic/beats is vulnerable to Information Disclosure. A local authenticated attacker is able to gain access to http request authorization or proxy-authorization header contents through leaked logs due to a flaw in httpjson input when debug logging is enabled, resulting in disclosure o...

Elastic Kibana < 8.7.1 Arbitrary Code Execution

The Elastic Kibana software on the remote host is missing a security update. It is, therefore, affected by multiple arbitrary code execution vulnerabilities: - An attacker with All privileges to the Uptime/Synthetics feature could send a request that will attempt to execute JavaScript code. This...

The vulnerability of the Elastic Search component in the Oracle PeopleSoft Enterprise PeopleTools business application suite allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of component AElastic Search in the Oracle PeopleSoft Enterprise PeopleTools business application suite exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

CVE-2023-30434

IBM Storage Scale IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0 could allow a local user to cause a kernel panic. IBM X-Force ID: 252187...

Code injection

IBM Storage Scale IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0 could allow a local user to cause a kernel panic. IBM X-Force ID: 252187...

CVE-2023-30434: Improper Input Validation

IBM Storage Scale IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0 could allow a local user to cause a kernel panic. IBM X-Force ID: 252187...

PT-2023-22688 · Ibm · Ibm Elastic Storage System +1

Name of the Vulnerable Software and Affected Versions: IBM Storage Scale versions 5.1.0.0 through 5.1.6.1 IBM Elastic Storage Systems versions 6.1.0.0 through 6.1.6.0 Description: The issue could allow a local user to cause a kernel panic. Recommendations: For IBM Storage Scale versions 5.1.0.0...

IBM Elastic Storage System 输入验证错误漏洞

The IBM Elastic Storage System is an appliance from International Business Machines IBM that is used for data management of large data volumes. An input validation error vulnerability exists in IBM Elastic Storage Systems for IBM Storage Scale. An attacker could exploit this vulnerability to caus...

Security Bulletin: IBM Elastic Storage System is affected by a vulnerability in IBM Spectrum Scale (CVE-2023-30434)

Summary IBM Elastic Storage Systems are affected by a vulnerability in IBM Spectrum Scale that could allow a local user to cause the kernel to panic. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2023-30434 DESCRIPTION: IBM Storage Scale could allow a local user to...