Moderate: Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update

An update for cockpit-composer, osbuild, osbuild-composer, and weldr-client is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

Moderate: git-lfs security and bug fix update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang:...

PT-2023-2691 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to synchronization errors when using a shared resource in the Windows Graphics Component. This can allow an attacker to elevate their privileges. The...

PT-2023-35817 · Git +1 · Harfbuzz

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN WRITE, with details provided in a crash state. The crash involves the...

Security Bulletin: Vulnerability in cURL libcurl affects IBM Process Mining . CVE-2023-23916

Summary There is a vulnerability in cURL libcurl that could allow a remote attacker to execute a denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-23916...

PT-2023-2785 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to bypass security restrictions. Recommendations: At the moment, there is no informatio...

The vulnerability of TP-Link T2600G-28SQ switch’s microprogramming software, related to errors in managing registration data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of TP-Link T2600G-28SQ switch’s microprogramming software is related to errors in managing registration data when processing SSH keys. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of antivirus protection tools such as Avast Antivirus, AVG Antivirus, and Avira Security for Windows operating systems allows a hacker to execute arbitrary files.

The vulnerability of antivirus protection tools such as Avast Antivirus, AVG Antivirus, and Avira Security for Windows operating systems is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to execute arbitrary files...

Upgraded Q -> 3 from #344 [1683218670048]

Judge has assessed an item in Issue 344 as 3 risk. The relevant finding follows: To ensure that there is no overflow when converting uint256 to uint128,and the totalNetInputAmount can be extracted so that it does not need to be calculated again later virtualBaseTokenReserves +=...

Vulnerability of the Oracle Solaris operating system’s Libraries component, related to errors in processing input data

The vulnerability of the Oracle Solaris operating system’s Libraries component is related to errors in processing input data. Exploiting this vulnerability can allow a remote attacker to execute a DoS attack...

The vulnerability of microprogrammed software in medical devices—the Illumina Universal Copy Service—allows a perpetrator to disclose protected information, upload and execute code with enhanced privileges.

The vulnerability of microprogrammed medical devices with the Illumina Universal Copy Service is related to errors in privilege management. Exploiting this vulnerability can allow a malicious actor to disclose protected information, upload and execute code with elevated privileges...

Upgraded Q -> 3 from #13 [1683219131959]

Judge has assessed an item in Issue 13 as 3 risk. The relevant finding follows: L-6 Consider using OpenZeppelin’s SafeCast library to prevent unexpected errors 3 --- The text was updated successfully, but these errors were encountered: 👍 1 sathishpic22 reacted with thumbs up emoji All reactions 👍...

The vulnerabilities of the software implementations of OPC UA methods for integrating communication with the Softing OPC UA C++ SDK, the data integration tool Softing edgeAggregator, and the software modules for connecting controllers such as Softing edgeConnector Modbus, Softing edgeConnector 840D, and Softing edgeConnector Siemens, allow attackers to cause service interruptions.

The vulnerability of the implementation of OPC UA software for connection integration with Softing OPC UA C++ SDK, the data integration tool Softing edgeAggregator, and the software modules for connecting controllers such as Softing edgeConnector Modbus, Softing edgeConnector 840D, and Softing...

Amazon Linux 2023 : libxml2, libxml2-devel, libxml2-static (ALAS2023-2023-163)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-163 advisory. A NULL pointer dereference exists when parsing invalid XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK CVE-2023-28484 libxml2 Hashing of empty dict strings isn't deterministic. When hashing...

Improper Input Validation

laminas/laminas-diactoros is vulnerable to Improper input Validation. The vulnerability exists because single new line characters are used between header keys or values allowing an attacker to create invalid messages, which can cause different application errors due to the syntactically incorrect...

The vulnerability of the Win32k.sys component of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Win32k.sys component of the Windows operating system is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow an attacker to increase their privileges...

Upgraded Q -> 2 from #882 [1683052816154]

Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: If royaltyFee 0 and recipient == address0 users will be overcharged --- The text was updated successfully, but these errors were encountered: All reactions...

The vulnerability of antivirus protection tools such as Avast Antivirus, AVG Antivirus, and Avira Security for Windows operating systems allows a hacker to trigger a service failure.

The vulnerability of antivirus protection tools such as Avast Antivirus, AVG Antivirus, and Avira Security for Windows operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow attackers to cause service interruptions...

Medium: libxml2

Issue Overview: A NULL pointer dereference exists when parsing invalid XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK CVE-2023-28484 libxml2 Hashing of empty dict strings isn't deterministic. When hashing empty strings which aren't null-terminated, xmlDictComputeFastKey could produce...

Amazon Linux 2 : libxml2 (ALAS-2023-2021)

The version of libxml2 installed on the remote host is prior to 2.9.1-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2021 advisory. A NULL pointer dereference exists when parsing invalid XML schemas in libxml2 xmlSchemaCheckCOSSTDerivedOK CVE-2023-28484...