CVE-2024-0323

The CVE-2024-0323 entry affects the B&R Automation Runtime FTP server, where the FTP service supports insecure encryption mechanisms (SSLv3, TLS 1.0, TLS 1.1). Affected product: B&R Automation Runtime (FTP server). Documented impact: network-based attacker can perform man-in-the-middle attacks or...

B&R Industrial Automation GmbH Runtime Encryption Issue Vulnerability

B&R Industrial Automation GmbH Runtime is a major component of AS from B&R Industrial Automation, an Austrian company. A cryptographic issue vulnerability exists in B&R Industrial Automation GmbH Runtime versions 14.0 through 14.93, which arises from the use of corrupted or risky cryptographic...

CVE-2023-6028: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...

CVE-2024-0323: Use of a Cryptographic Primitive with a Risky Implementation

The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product clients...

B&R Industrial Automation GmbH Runtime Cross-Site Scripting Vulnerability

B&R Industrial Automation GmbH Runtime is a major component of AS from B&R Industrial Automation, an Austrian company. A cross-site scripting vulnerability exists in B&R Industrial Automation GmbH Runtime G4.93 and earlier versions, which originates from a vulnerability that could allow a remote...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 8 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVEs and we recommend updating to the latest version to remediat...

Denial Of Service (DoS)

Bref is vulnerable to Denial Of Service DoS. The vulnerability is due to improper clean up of temporary files after processing a MultiPart requests when the Event-Driven Function runtime is utilized and the handler is a RequestHandlerInterface. This allows an attacker to fill the Lambda instance...

Important: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: runc: file descriptor leak CVE-2024-21626 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

Bref's Uploaded Files Not Deleted in Event-Driven Functions

Impacted Resources bref/src/Event/Http/Psr7Bridge.php:94-125 Description When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each...

CVE-2024-24754

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a "RequestHandlerInterface", then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and its content...

CVE-2024-24752

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a "RequestHandlerInterface", then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each...

PT-2024-20530 · Bref · Bref

Name of the Vulnerable Software and Affected Versions: Bref versions prior to 2.1.13 Description: The issue arises when Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface. In this scenario, the Lambda event is converted to a PSR7 object. During the...

PT-2024-8504

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to a resource management issue in the dg dispatch as host function of the VMCI component in the Linux kernel. The issue arises from a memcpy operation that...

PT-2024-20532

Name of the Vulnerable Software and Affected Versions Bref versions prior to 2.1.13 Description The vulnerability occurs when Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface. In this scenario, the Lambda event is converted to a PSR7 object. During...

The vulnerability of the apr_encode function in the Apache Portable Runtime library allows a hacker to execute arbitrary code.

The vulnerability of the aprencode function in the Apache Portable Runtime APR library is related to integer overflow when processing field lengths. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

GLSA-202401-31 : containerd: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202401-31 containerd: Multiple Vulnerabilities - containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Uni...

evm (>=0.13.0, <=0.20.0), evm-gasometer (>=0.13.0, <=0.20.0) +2 more potentially affected by CVE-2021-29511 via evm-core (>=0.13.1, <=0.20.0)

evm-core CARGO version =0.13.1, =0.13.0, =0.13.0, =0.13.0, =2.0.0-alpha.3, =2.0.1 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

evm (>=0.22.0, <=0.22.1), evm-gasometer (0.22.0) +1 more potentially affected by CVE-2021-29511 via evm-core (0.22.0)

evm-core CARGO version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on evm-core and may be impacted: - evm =0.22.0, =0.22.1 - evm-gasometer 0.22.0 - evm-runtime 0.22.0 Source cves: CVE-2021-29511 Source advisory: OSV:GHSA-4JWQ-572W-4388...

runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration

A flaw was found in runc. This vulnerability could allow a remote attacker to bypass security restrictions and create a symbolic link inside a container to the /proc directory, bypassing AppArmor and SELinux protections...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Content Manager Enterprise Edition 8.5.0 (CVE-2016-3449, CVE-2016-0264)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7 that is used by Content Manager Enterprise Edition. These issues were disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details If you run your own Java code using the IBM Java Runtime...