10185 matches found
UBUNTU-CVE-2023-27476
OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...
samba security update
4.10.16-24.0.1 - Fix memory leak in nsswinbindinitgroupsdyn Orabug: 34228871 4.10.16-24 - related: 2154364 - Add additional patches for CVE-2022-38023 4.10.16-23 - resolves: 2154364 - Fix CVE-2022-38023...
Debian: Security Advisory (DLA-1434-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2023-27476
OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution, and could lead to arbitrary file reads from an...
CVE-2023-27476
OWSLib is a Python package for client programming with Open Geospatial Consortium OGC web service interface standards, and their related content models. OWSLib's XML parser which supports both "lxml" and "xml.etree" does not disable entity resolution, and could lead to arbitrary file reads from a...
GHSA-8H9C-R582-MGGC OWSLib vulnerable to XML External Entity (XXE) Injection
Impact OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. Patches - Use only lxml for XML handling, adding...
OWSLib vulnerable to XML External Entity (XXE) Injection
Impact OWSLib's XML parser which supports both lxml and xml.etree does not disable entity resolution for lxml, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase. Patches - Use only lxml for XML handling, adding...
PT-2023-21153
Name of the Vulnerable Software and Affected Versions OWSLib versions prior to 0.28.1 Description The XML parser in OWSLib does not disable entity resolution, which could lead to arbitrary file reads from an attacker-controlled XML payload. This issue affects all XML parsing in the codebase. The...
CVE-2023-25146: Improper Link Resolution Before File Access
A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete the original folder and replace with a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to an arbitrary location. Please note...
IBM Rational ClearCase 8.0 < 9.0.1.14 / 9.0.2 < 9.0.2.6 / 9.1 < 9.1.0.3 Multiple Vulnerabilities
The version of IBM Rational ClearCase installed on the remote host is affected by multiple vulnerabilities, including the following: - A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when '--no-clobber' is used together with '--remove-on-error'...
PT-2025-18814
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak issue has been identified in the Linux kernel related to thunderbolt, specifically in the margining functionality for usb4. The memory for usb4-margining needs to be releas...
USN-5907-1: c-ares vulnerability
It was discovered that c-ares incorrectly handled certain sortlist strings. A remote attacker could use this issue to cause c-ares to crash, resulting in a denial of service, or possibly execute arbitrary code...
USN-5902-1 php7.2, php7.4, php8.1 vulnerabilities
It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly allow applications to accept any password as valid, contrary to expectations. CVE-2023-0567 It was discovered that PHP incorrectly handled resolving long paths. A remot...
MGASA-2023-0065 Updated php packages fix security vulnerability
The passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. CVE-2023-0567 The core path resolution function allocates a buffer one byte too...
Updated php packages fix security vulnerability
The passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. CVE-2023-0567 The core path resolution function allocates a buffer one byte too...
CVE-2022-22582: Improper Link Resolution Before File Access
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5, macOS Monterey 12.3. A local user may be able to write arbitrary files...
PT-2025-18802
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the lpfc sli4 cgn params read function, where a failed kzalloc call could lead to a NULL pointer dereferenc...
SUSE SLES12: apache2-mod_php74 / php74 / php74-bcmath / php74-bz2 / etc (SUSE-SU-2023:0515-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0515-1 advisory. - CVE-2023-0568: Fixed NULL byte off-by-one in phpcheckspecificopenbasedir bnc1208366. - CVE-2023-0662: Fixed DoS vulnerability whe...
Fedora 37 : php (2023-452714dbc6)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-452714dbc6 advisory. PHP version 8.1.16 14 Feb 2023 Core: Fixed bug php81744 Passwordverify always return true with some hash. CVE-2023-0567. Tim Dsterhus Fixed bug...
