XWiki 9.4-rc-1 < 14.10.8, 15.0-rc-1 < 15.3 Information Disclosure Vulnerability (GHSA-gh64-qxh5-4m33)

Xwiki is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

XWiki 3.5-milestone-1 < 14.10.8, 15.0-rc-1 < 15.3 XSS Vulnerability (GHSA-vcvr-v426-3m3m)

Xwiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki";...

GHSA-4JQ9-2XHW-JPX7 vulnerabilities

Vulnerabilities for packages: hadoop-fips...

Attacker can cause Kyverno user to unintentionally consume insecure image

An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno users. The issue would require the attacker to compromise the registry that the Kyverno fetch their images from. The attacker could then return a vulnerable image to the the user and leverage th...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: spark-operator, prometheus-adapter, kubernetes-dns-node-cache, aws-efs-csi-driver, nodetaint, ip-masq-agent...

GHSA-8PGV-569H-W5RW vulnerabilities

Vulnerabilities for packages: docker-compose, kubernetes, temporal-server, rancher-webhook-fips, temporal, k3s, temporal-server-fips, cri-tools, envoy-ratelimit, metrics-server-fips, kubernetes-csi-external-resizer, kube-oidc-proxy, kine, metrics-server, volume-modifier-for-k8s, aws-ebs-csi-drive...

GHSA-4QHC-V8R6-8VWM vulnerabilities

Vulnerabilities for packages: k3d...

GHSA-WF5P-G6VW-RHXX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards...

Fedora 39 : python-fastapi / python-starlette (2023-a96ec52457)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-a96ec52457 advisory. Update python-starlette to 0.27.0 and python-fastapi to 0.95.2. Fixes GHSA-v5gw-mw7f-84px Path traversal vulnerability in StaticFiles. Tenable has extracted...

MAL-2023-8466 Malicious code in turbolinks-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54430362bf4de07fb5f82d6de95632bb22951198c05b2242a0a547dc4771b72c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-MR45-RX8Q-WCM9 vulnerabilities

Vulnerabilities for packages: nats, nats-server, minio, k3s...

GHSA-5WJ4-WFFQ-3378 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-5WJ4-WFFQ-3378 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GHSA-FP9F-44C2-CW27 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller-fips, ingress-nginx-controller...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: slsa-verifier, kubescape, dgraph, scorecard, terraform-provider-sendgrid, up, spark-operator, k3d, kubeflow, src, buildkitd, cortex, kubevela, aactl...

GHSA-MQ26-G339-26XF vulnerabilities

Vulnerabilities for packages: k8s-sidecar, jwt-tool...

GHSA-MM8H-8587-P46H vulnerabilities

Vulnerabilities for packages: trino, cassandra-reaper...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Sofia-SIP vulnerability (USN-6448-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6448-1 advisory. Xu Biang discovered that Sofia-SIP did not properly manage memory when handling STUN packets. An attacker coul...

CVE-2023-41899

Home Assistant Core vulnerability CVE-2023-41899: a partial SSRF in the hassio.addon_stdin service allows an attacker who can call that service (e.g., via GHSA-h2jp-7grc-9xpp) to invoke any Supervisor REST API endpoints through a POST request. An exploited attacker can control the data dictionary...

CVE-2023-41899 Partial Server-Side Request Forgery in Home Assistant Core

Home assistant is an open source home automation. In affected versions the hassio.addonstdin is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service e.g.: through GHSA-h2jp-7grc-9xpp may be able to invoke any Supervisor REST API endpoints with a PO...