Moderate: Red Hat Security Advisory: Red Hat Integration Camel Extensions For Quarkus 2.13.2

Red Hat Integration Camel Extensions for Quarkus 2.13.2 is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System CVSS base score,...

SUSE SLES15: ruby2.5-rubygem-websocket-extensions / etc (SUSE-SU-2023:0127-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0127-1 advisory. - CVE-2020-7663: Fixed an excessive resource consumption when parsing crafted message headers sent by an attacker bsc1172445. Tenable has...

SUSE-SU-2023:0127-1 Security update for rubygem-websocket-extensions

This update for rubygem-websocket-extensions fixes the following issues: - CVE-2020-7663: Fixed an excessive resource consumption when parsing crafted message headers sent by an attacker bsc1172445...

Remote Code Execution(RCE)

libxpm is vulnerable to Remote Code ExecutionRCE. When processing .Z or .gz file extensions, the library calls external programs to compress and uncompress files. This could allow a malicious user to execute other programs by manipulating the PATH environment variable...

libXpm: compression commands depend on $PATH

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...

libXpm: compression commands depend on $PATH

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH...

WordPress Extensions For CF7 Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Extensions For CF7 Type Plugin Vulnerable versions = 2.0.8 Fixed in 2.0.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23899 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 0538927ff62d Credits István Márton...

Speculative execution attacks in KVM VMX

...

com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 (>=1.4.0, <=1.7.0-ms3), com.buschmais.jqassistant.neo4jserver:neo4jv3 (>=1.4.0, <=1.7.0-ms3) +10 more potentially affected by CVE-2022-23532 via org.neo4j.procedure:apoc (>=3.4.0.1, <=3.5.0.15)

org.neo4j.procedure:apoc MAVEN version =3.4.0.1, =1.4.0, =1.4.0, =1.4.0, =1.8.0, =1.10.0 - org.jqassistant.contrib.plugin:jqassistant-plantuml-rule-plugin 1.7.0 Source cves: CVE-2022-23532 Source advisory: MEND:CVE-2022-23532...

com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 (1.4.0), com.buschmais.jqassistant.neo4jserver:neo4jv3 (1.4.0) +8 more potentially affected by CVE-2022-23532 via org.neo4j.procedure:apoc (3.4.0.1)

org.neo4j.procedure:apoc MAVEN version 3.4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.neo4j.procedure:apoc and may be impacted: - com.buschmais.jqassistant.cli:jqassistant-commandline-neo4jv3 1.4.0 -...

ALPINE-CVE-2022-3515

A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment...

Google Chrome Buffer Overflow Vulnerability (CNVD-2023-12026)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security vulnerability that originates from a boundary error in the platform application for untrusted inputs, which can be exploited by a remote attacker to convince users to install malicious extension...

CVE-2022-3592: UNIX Symbolic Link (Symlink) Following

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...

CVE-2022-3592

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...

CVE-2022-3592

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks...

GLSA-202301-09 : protobuf-java: Denial of Service

The remote host is affected by the vulnerability described in GLSA-202301-09 protobuf-java: Denial of Service - A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple...

CVE-2023-0134

Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via database corruption and a crafted HTML page. Chromium security severity: Medium...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser from Google, Inc. in the United States. Google Chrome has a security vulnerability that stems from the use of free in the shopping cart allows an attacker to convince users to install malicious extensions, an attacker can exploit the vulnerability by exploiting heap...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser from Google, Inc. in the United States. Google Chrome has a security vulnerability that stems from the use of free in the shopping cart allows an attacker to convince users to install malicious extensions, an attacker can exploit the vulnerability by exploiting heap...

Hackers Can Abuse Visual Studio Marketplace to Target Developers with Malicious Extensions

A new attack vector targeting the Visual Studio Code extensions marketplace could be leveraged to upload rogue extensions masquerading as their legitimate counterparts with the goal of mounting supply chain attacks. The technique "could act as an entry point for an attack on many organizations,"...