OpenMage LTS 命令注入漏洞

OpenMage Magento Lts Magento is an e-commerce system organized by OpenMage. A command injection vulnerability exists in OpenMage LTS versions 19.4.22 through 20.0.19, which stems from Custom Layout that enables an administrator user to execute arbitrary commands via the block method...

PT-2023-19079 · Unknown · Openmage Lts

Name of the Vulnerable Software and Affected Versions: OpenMage LTS versions prior to 19.4.22 OpenMage LTS versions prior to 20.0.19 Description: The issue is related to an infinite loop in the malicious code filter under certain conditions. There are no known workarounds for this problem...

Ubuntu: Security Advisory (USN-4812-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-4780-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-5367-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5822-2: Samba regression

USN-5822-1 fixed vulnerabilities in Samba. The update for Ubuntu 20.04 LTS introduced regressions in certain environments. Pending investigation of these regressions, this update temporarily reverts the security fixes. We apologize for the inconvenience. Original advisory details: It was discover...

GHSA-R3C9-9J5Q-PWV4 magento-lts Reset Password not protected against well-timed CSRF

Impact Password reset form is vulnerable to CSRF between time reset password link is clicked and user submits new password. Patches PR forthcoming Workarounds None...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to query parameter smuggling due to [CVE-2022-2880]

Summary Some components of IBM App Connect Enterprise Certified Container operator and operands are implemented in Golang Go. These components may be vulnerable to query parameter smuggling. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2022-2880...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to elevated privileges due to [CVE-2022-42919]

Summary Python is used by IBM App Connect Enterprise Certified Container for providing mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to elevated privileges. This bulletin provides patch information to...

Security Bulletin: IBM MQ could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. (CVE-2022-31772)

Summary IBM MQ could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. Vulnerability Details CVEID:CVE-2022-31772 DESCRIPTION: IBM MQ could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. CVSS Base score: 5....

[SECURITY] [DLA 3281-1] swift security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-3281-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta January 25, 2023 https://wiki.debian.org/LTS -...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : PAM vulnerability (USN-5825-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5825-1 advisory. It was discovered that PAM did not correctly restrict login from an IP address that is not resolvable via DNS. An attacker cou...

[SECURITY] [DLA 3280-1] libde265 security update

Debian LTS Advisory DLA-3280-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost January 24, 2023 https://wiki.debian.org/LTS Package : libde265 Version : 1.0.3-1+deb10u2 CVE ID : CVE-2020-21596 CVE-2020-21597 CVE-2020-21598 CVE-2022-43235 CVE-2022-43236 CVE-2022-43237...

USN-5822-1: Samba vulnerabilities

It was discovered that Samba incorrectly handled the bad password count logic. A remote attacker could possibly use this issue to bypass bad passwords lockouts. This issue was only addressed in Ubuntu 22.10. CVE-2021-20251 Evgeny Legerov discovered that Samba incorrectly handled buffers in certai...

USN-5806-2: Ruby vulnerability

USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.10. Original advisory details: Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi ge...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : PHP vulnerability (USN-5818-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5818-1 advisory. It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute...

Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Setuptools vulnerability (USN-5817-1)

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5817-1 advisory. Sebastian Chnelik discovered that setuptools incorrectly handled certain regex inputs. An attacker could possibly use this iss...

Debian dla-3278 : libtiff-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3278 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3278-1 [email protected]...

[SECURITY] [DLA 3278-1] tiff security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3278-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler January 20, 2023 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3277-1] powerline-gitstatus security update

Debian LTS Advisory DLA-3277-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany January 20, 2023 https://wiki.debian.org/LTS Package : powerline-gitstatus Version : 1.3.2-0+deb10u1 CVE ID : CVE-2022-42906 Powerline Gitstatus, a status line plugin for the VIM editor...