Desigo DXR2 Authentication Bypass

The vulnerability of the microprogramming software for the Desigo DXR2, PXC3, PXC4, and PXC5 station modules is related to the absence of authentication attempt limits. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information by...

Debian DSA-5150-1 : rsyslog - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5150 advisory. - Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This...

rsyslog: Heap-based overflow in TCP syslog server

A flaw was found in rsyslog's reception TCP modules. This flaw allows an attacker to craft a malicious message leading to a heap-based buffer overflow. This issue allows the attacker to corrupt or access data stored in memory, leading to a denial of service in the rsyslog or possible remote code...

rsyslog: Heap-based overflow in TCP syslog server

A flaw was found in rsyslog's reception TCP modules. This flaw allows an attacker to craft a malicious message leading to a heap-based buffer overflow. This issue allows the attacker to corrupt or access data stored in memory, leading to a denial of service in the rsyslog or possible remote code...

DRUPAL-CORE-2022-010

Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside...

Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-010

Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which does not affect Drupal core, but may affect some contributed projects or custom code on Drupal sites. We are issuing this security advisory outside...

GO-2022-0247 Buffer overflow in WASM modules in misc/wasm and cmd/link

When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments due to a buffer overflow error. If using wasmexec.js to execute WASM modules, users will need to replace their...

Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Deployment Intelligence app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2020-24025 DESCRIPTION: node-sass...

GHSA-XXW3-765M-F37P SaltStack Salt Improper Authentication vulnerability

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheelasync client. Thus, an attacker can remotely run any wheel modules on the master...

Silverstripe CMS malicious file upload enables script execution

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions for example HTML code in a TXT file. When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Upload...

GHSA-H77W-655F-6J3M Silverstripe CMS malicious file upload enables script execution

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions for example HTML code in a TXT file. When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Upload...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2020-1724 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

com.lookout.jenkins:environment-script (>=1.2, <=1.2.3), org.jenkins-ci.main:jenkins-test-harness (1.565) +26 more potentially affected by CVE-2020-2100 via org.jenkins-ci.main:jenkins-core (1.565)

org.jenkins-ci.main:jenkins-core MAVEN version 1.565 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.lookout.jenkins:environment-script =1.2, =1.0, =0.1, =2.0, =1.23, =1.0.0, =1.0-beta-1, =1.3...

com.foreach.across.modules:across-hibernate-module (4.0.0.release), com.foreach.across.modules:admin-web-module (4.0.0.release) +171 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (5.1.13.release)

org.springframework:spring-web MAVEN version 5.1.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - com.foreach.across.modules:across-hibernate-module 4.0.0.release -...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

com.opennewway:onw-test (1.0d11), com.opennewway:onw-web (1.0d11) +43 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (5.2.6.final)

org.infinispan:infinispan-core MAVEN version 5.2.6.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - com.opennewway:onw-test 1.0d11 - com.opennewway:onw-web 1.0d11 -...

org.hibernate:hibernate-search-infinispan (5.0.0.beta1), org.hibernate:hibernate-search-modules (5.0.0.beta1) +29 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.0.0.cr2)

org.infinispan:infinispan-core MAVEN version 7.0.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.hibernate:hibernate-search-infinispan 5.0.0.beta1 - org.hibernate:hibernate-search-modules...

org.infinispan:infinispan-as-embedded-modules (7.1.0.beta1), org.infinispan:infinispan-cachestore-jdbc (7.1.0.beta1) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.1.0.beta1)

org.infinispan:infinispan-core MAVEN version 7.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.1.0.beta1 -...

org.infinispan:infinispan-as-embedded-modules (7.1.0.cr1), org.infinispan:infinispan-cachestore-jdbc (7.1.0.cr1) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.1.0.cr1)

org.infinispan:infinispan-core MAVEN version 7.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.1.0.cr1 -...

org.infinispan:infinispan-as-embedded-modules (7.0.1.final), org.infinispan:infinispan-cachestore-jdbc (7.0.1.final) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.0.1.final)

org.infinispan:infinispan-core MAVEN version 7.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.0.1.final -...