Security Bulletin: Multiple vulnerabilities affect embedded Content Management Interoperability Service in IBM Business Automation Workflow - CVE-2023-20861, CVE-2023-20863

Summary Embedded Content Management Interoperability Service in IBM Business Automation Workflow is affected by multiple Spring framework vulnerabilities Vulnerability Details CVEID:CVE-2023-20863 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper...

SUSE: Security Advisory (SUSE-SU-2023:2990-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:2990-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Updated to jdk-11.0.20+8 July 2023 CPU: - CVE-2023-22006: Fixed vulnerability in the network component bsc1213473. - CVE-2023-22036: Fixed vulnerability in the utility component bsc1213474. - CVE-2023-22041: Fixed vulnerability in the...

PT-2023-10181

Name of the Vulnerable Software and Affected Versions git-annex versions affected versions not specified Description The issue concerns the storage of embedded credentials on encrypted remotes in git-annex. When embedcreds=yes is set and the remote uses encryption=pubkey or encryption=hybrid, the...

Stored XSS in Preview title

Description There is accumulated XSS in the preview title of the page. Proof of Concept Step 1. Log in to the administrator screen and create a new page. Step 2. Insert "Browse preview" from "Add new block" and specify Payload in "Preview title". Step 3. When you access the preview screen in the...

K000135534: Java vulnerabilities CVE-2020-14779, CVE-2020-14782

Security Advisory Description CVE-2020-14779 Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Serialization. Supported versions that are affected are Java SE: 7u271, 8u261, 11.0.8 and 15; Java SE Embedded: 8u261. Difficult to exploit vulnerability allows...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Vim's embedded terminal allows injection via DECRQSS response

Description DECRQSS is a terminal response that replies with certain information about the terminal. Various terminals have bugs where a piece of data from the request i.e. data that the terminal receives is echoed back in the reply. In some cases this is enough to make it so if untrusted data...

The vulnerability of the TrustZone subsystem’s networking (netdev) component in Qualcomm embedded operating systems allows a hacker to trigger a service failure.

The vulnerability of the TrustZone subsystem’s Networking netdev component in Linux embedded devices from Qualcomm involves a re-liberation of memory during kernel loading at the HYP level. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of Android and Linux operating systems in Qualcomm embedded devices, related to the execution of operations outside of the buffer in memory, allows attackers to trigger system failures.

The vulnerability of Android and Linux operating systems in Qualcomm embedded devices lies in the fact that operations are performed outside of the buffer in memory. Exploiting this vulnerability can allow an attacker to trigger a service failure by sending specially crafted DRM requests...

The vulnerability of GPS HLOS driver for Android operating systems in Qualcomm embedded chips allows a hacker to trigger a service failure.

The vulnerability of the GPS HLOS driver for Android operating systems in Qualcomm embedded chips is related to the re-release of memory upon calling the cancellation registration function after registration. Exploiting this vulnerability can allow a hacker to cause a service failure...

The vulnerability of the Gunyah Resource Manager service on Android and Linux embedded platforms of Qualcomm devices allows a hacker to induce a service failure.

The vulnerability of the Gunyah Resource Manager service for Android and Linux embedded devices on Qualcomm systems is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a attacker to cause a service failure by sending specially crafted messages from the...

CVE-2023-2912

Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction...

Design/Logic Flaw

Use After Free vulnerability in Secomea SiteManager Embedded allows Obstruction...

CVE-2023-2912

CVE-2023-2912 is a reported Use-After-Free in Secomea SiteManager Embedded leading to service disruption (obstruction). Affected product/component: SiteManager Embedded. Root cause: use-after-free condition as described across multiple sources; impact is availability disruption. CVSSv3.1 base sco...

Secomea SiteManager 资源管理错误漏洞

Secomea SiteManager is a software application from Secomea, Denmark. It provides a remote maintenance function for industrial equipment. A security vulnerability exists in Secomea SiteManager Embedded, which originates from the presence of a post-release reuse vulnerability...

The vulnerability of the Utilities component in Oracle Java SE and Java SE Embedded software platforms allows a attacker to trigger a service failure.

The vulnerability of the Utilities component in Oracle Java SE and Java SE Embedded software platforms is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

PT-2023-22161 · Secomea · Secomea Sitemanager Embedded

Name of the Vulnerable Software and Affected Versions: Secomea SiteManager Embedded affected versions not specified Description: The issue is related to a Use After Free vulnerability, which allows obstruction. There is no information provided about the estimated number of potentially affected...

CVE-2023-2003

Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device...

Code injection

Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can then be retrieved by a client and executed on the device...