SUSE CVE-2020-36478

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. A NULL algorithm parameters entry looks identical to an array of REAL size zero and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands may be vulnerable to insertion of sensitive information into log files due to [CVE-2022-42439]

Summary IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Discovery Connector nodes may be vulnerable to insertion of sensitive information into log files. This bulletin provides patch information to address the reported vulnerability. CVE-2022-42439...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to denial of service due to [CVE-2022-32189]

Summary Some components of IBM App Connect Enterprise Certified Container operator and operands are implemented in Golang Go. These components may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2022-32189...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to [CVE-2022-23491]

Summary Python module certifi is used by IBM App Connect Enterprise Certified Container for mapping assistance. IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to verifying untrustworth certificates. This bulletin provides...

GHSA-Q2FJ-6H62-59M2 Apiman Vert.x Gateway has Transitive Hazelcast connection caching issue

Impact If you are using the Apiman Vert.x Gateway prior to Apiman 3.0.0.Final, a connection caching issue in Hazelcast could allow an unauthenticated, remote attacker to access and manipulate data in the cluster with another authenticated connection's identity. Hazelcast is a transitive dependenc...

PowerShell LTS v7.2.8 (x64)

Install or update to PowerShell Long Term Support version v7.2.8 x64...

OpenHarmony 缓冲区错误漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom Foundation OpenAtom Foundation Foundation. A security vulnerability exists in OpenHarmony kernelliteosa, which originates from a kernel stack overflow in the kernel subsystem during a call to SysClockGetres,...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to denial of service due to CVE-2022-0561

Summary LibTIFF is not used directly by IBM App Connect Enterprise Certified Container but is present in the DesignerAuthoring image used for mapping assistance, which may be vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance may be vulnerable to arbitrary code execution due to CVE-2022-1355

Summary LibTIFF is not used directly by IBM App Connect Enterprise Certified Container but is present in the DesignerAuthoring image used for mapping assistance, which may be vulnerable to arbitrary code execution or denial of service. This bulletin provides patch information to address the...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to arbitrary code execution due to CVE-2015-20107

Summary Python is provided as part of the operating system modules in the IBM App Connect Enterprise Certified Container images, and is used by DesignerAuthoring instances when mapping assistance is enabled. IBM App Connect Enterprise Certified Container images may be vulnerable to arbitrary code...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service due to CVE-2022-36083

Summary Node.js module jose is used by IBM App Connect Enterprise Certified Container for securing internal communications and in connections by connectors to SaaS endpoints. IBM App Connect Enterprise Certified Container operands may be vulnerable to denial of service. This bulletin provides pat...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to loss of confidentiality due to CVE-2022-29244

Summary Node.js is used by all IBM App Connect Enterprise Certified Container operands. IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability CVE-2022-29244 in Node.js...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that process yaml files may be vulnerable to denial of service due to CVE-2022-25857

Summary SnakeYAML is used by IBM App Connect Enterprise Certified Container for parsing YAML files, including IntegrationServer configuration files. IBM App Connect Enterprise Certified Container IntegrationServer operands may be vulnerable to denial of service. This bulletin provides patch...

CLSA-2022-1660064249 Fix CVE(s): CVE-2022-21434, CVE-2022-21426, CVE-2022-21443, CVE-2022-34169, CVE-2022-21540, CVE-2022-21541, CVE-2022-21476, CVE-2022-21496

Backport upstream releases 8u342 and 8u332 to 16.04 LTS Security fixes in 8u342: - JDK-8272243: Improve DER parsing - JDK-8272249: Better properties of loaded Properties - JDK-8277608: Address IP Addressing - JDK-8281859, CVE-2022-21540: Improve class compilation - JDK-8281866, CVE-2022-21541:...

[SECURITY] [DLA 3067-1] Debian 9 Long Term Support reaching end-of-life

------------------------------------------------------------------------- Debian LTS Advisory DLA-3067-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 01, 2022 https://wiki.debian.org/LTS -...

PT-2022-22369 · Jenkins · Jenkins Failed Job Deactivator Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Failed Job Deactivator Plugin versions 1.2.1 and earlier Jenkins versions 2.286 and earlier Jenkins LTS versions 2.277.1 and earlier Description: A cross-site request forgery CSRF issue allows attackers to disable jobs. This issue is...

GHSA-MHP7-3393-PFQR Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescap...

CVE-2022-34174

In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an invalid username, and login attempts with a valid username and wrong password, when using the Jenkins user database security realm...

PT-2022-22053 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Date Parameter Plugin versions 0.0.4 and earlier Description: The issue is a stored cross-site scripting XSS vulnerability that occurs because the Jenkins Date Parameter Plugin does not escape the name and description of Date paramete...

GHSA-HVMC-7G2X-R3P9 Jenkins Cross-Site Scripting vulnerability in help icons

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting XSS vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the...