Advisory ROSA-SA-2023-2215

Software: vim 8.0.1763 OS: ROSA Virtualization 2.1 packageevrstring: vim-8.0.1763-19.rv3.4.src.rpm CVE-ID: CVE-2022-0392 BDU-ID: 2022-00992 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the getexmodeline exgetln.c function of the vim text editor is related to writing beyond buffer boundaries in...

Information disclosure

HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information...

CVE-2023-23347

CVE-2023-23347 affects HCL DRYiCE iAutomate. The vulnerability arises from the use of a broken cryptographic algorithm, potentially compromising confidentiality and integrity of sensitive information. Documented risk scores indicate high severity in some feeds (NVD CVSS v3.1: AV=L/AC=L/PR=L/UI:N/...

CVE-2023-23347 Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomate

HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information...

CVE-2023-23346 Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud

HCL DRYiCE MyCloud is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information...

CVE-2023-23346

CVE-2023-23346 affects HCL DRYiCE MyCloud and is caused by the use of a broken cryptographic algorithm, potentially compromising confidentiality and integrity of sensitive data. Multiple sources (NVD entry and mirrored records) confirm the issue, describing the vulnerability as related to weak cr...

The vulnerability of Google Chrome’s Sandbox component allows a violator to gain unauthorized access to protected information, compromise its integrity, or cause service failures.

The vulnerability of Google Chrome’s Sandbox component is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information, compromise its integrity, or cause service failures...

[SECURITY] [DLA 3515-1] cjose security update

Debian LTS Advisory DLA-3515-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin August 04, 2023 https://wiki.debian.org/LTS Package : cjose Version : 0.6.1+dfsg1-1+deb10u1 CVE ID : CVE-2023-37464 Debian Bug : 1041423 An incorrect Authentication Tag length usage was...

Design/Logic Flaw

In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfe...

CVE-2023-37551 CODESYS Files or Directories Accessible to External Parties in CmpApp

In multiple Codesys products in multiple versions, after successful authentication as a user, specially crafted network communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfe...

The vulnerability of the Runc command-line tool for running isolated containers, related to improper storage of permissions, allows a malicious actor to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Runc container launch tool is related to improper storage of permissions. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of Vim text editors, related to integer overflows, allows attackers to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the Vim text editor is related to integer overflow. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and even cause service interruptions...

The vulnerability in the `libcontainer/rootfs_linux.go` component of the Runc tool for running isolated containers allows a attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the libcontainer/rootfslinux.go component, a tool for running isolated containers in Runc, is related to the use of a name with an incorrect reference. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity, and cause service...

The vulnerability of the OpenSSH cryptographic protection mechanism lies in the insecure management of privileges. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the OpenSSH cryptographic protection mechanism is related to insecure management of privileges. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to writing beyond the buffer limit, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a remote attacker to access confidential data, compromise its integrity, and cause service failures...

Arbitrary Pending _setPendingVetoer Address Assignment.

Lines of code Vulnerability details Impact If an attacker successfully impersonates the vetoer, they can set any address as the pending vetoer. This can compromise the integrity of the vetoer role and enable unauthorized access or control over certain functions or actions within the contract. Pro...

CVE-2023-36924

CVE-2023-36924 affects SAP ERP Defense Forces and Public Security, versions 600–807. The root cause is improper handling of log output allowing an authenticated admin to write arbitrary data to the syslog file, potentially altering all syslog data and compromising application integrity. Affected ...

CVE-2023-36924 Log Injection vulnerability in SAP ERP Defense Forces and Public Security

While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could...

Huawei HarmonyOS and EMUI Buffer Overflow Vulnerability

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A buffer overflow vulnerability exists in Huawei...

The vulnerability of the Google Chrome browser extension allows a perpetrator to access confidential data, compromise its integrity, and also cause service interruptions.

The vulnerability of the Google Chrome browser extension is related to the overflow of the heap buffer and the installation of malicious extensions. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service interruptions throug...