Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager (CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2024-20952 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow a remote attacker t...

Malicious code in super-social-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acf38469c6e1fd929fce485f4b3ff1b4f3d7399422a92e8b23c61339502ad299 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-V8MX-HP2Q-GW85 Golang SDK for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

GHSA-W5WX-6G2R-R78Q Nuclei allows unsigned code template execution through workflows

Overview A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This...

Nuclei allows unsigned code template execution through workflows

Overview A significant security oversight was identified in Nuclei v3, involving the execution of unsigned code templates through workflows. This vulnerability specifically affects users utilizing custom workflows, potentially allowing the execution of malicious code on the user's system. This...

.NET 7.0 security update

7.0.117-1.0.1 - Update to .NET SDK 7.0.117 and Runtime 7.0.17 - Port Revert 'Disable implicit rejection for RSA PKCS1 95217 patch...

Security Bulletin: Multiple security vulnerabilities in IBM SDK, Java Technology Edition affects IBM OpenPages

Summary IBM® SDK, Java™ Technology Edition is shipped as a supporting program of IBM OpenPages. Information about a security vulnerability affecting IBM SDK, Java Technology Edition has been published in multiple security bulletins. These products have addressed the applicable CVEs. For a complet...

.NET 8.0 security update

8.0.103-1.0.1 - Update to .NET SDK 8.0.103 and Runtime 8.0.3 - Backport MSBuild locale fix...

.NET 7.0 security update

7.0.117-1.0.1 - Update to .NET SDK 7.0.117 and Runtime 7.0.17 - Port revert 'Disable implicit rejection for RSA PKCS1 95217' patch - 7.0.116-1.0.1 - Update to .NET SDK 7.0.116 and Runtime 7.0.16 Tue Jan 16 2024 Lukas Lipinsky - 7.0.115-1.0.1 - Update to .NET SDK 7.0.115 and Runtime 7.0.15...

.NET 8.0 security update

8.0.103-2.0.1 - Update to .NET SDK 8.0.103 and Runtime 8.0.3 - Disable checking the signature of the last certificate in a chain if the certificate is supposedly self-signed. - Resolves: RHEL-25254 - Backport MSBuild locale fix - Resolves: RHEL-23936...

Moderate: Red Hat Security Advisory: .NET 7.0 security update

An update for .NET 7.0 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Moderate: Red Hat Security Advisory: .NET 7.0 security update

An update for .NET 7.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Improper Input Validation

github.com/cosmos/cosmos-sdk is vulnerable to Improper Input Validation. The vulnerability is due to inadequate validation in the ValidateVoteExtensions function within abciutils.go. This flaw allows attackers to exploit the ValidateVoteExtensions helper function by inferring total voting power...

.NET Core Multiple Denial of Service Vulnerabilities (KB5036452)

.NET Core is prone to multiple denial of service vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security Update for Microsoft .NET Core SDK (March 2024)

The version of .NET Core SDK installed on the remote host is 6.x prior to 6.0.27, 7.x prior to 7.0.16 or 8.x prior to 8.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the February 2024 advisory: - A vulnerability exists in .NET where specially crafted requests may...

Moderate: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.103 and .NET Runtime 8.0.3...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to unsafe deserialization due to IBM SDK (CVE-2022-40609)

Summary IBM Sterling Partner Engagement Manager uses IBM SDK, Java Technology Edition. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2022-40609 DESCRIPTION: IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote attack...

CVE-2024-21421

Azure SDK Spoofing Vulnerability...

Spoofing

Azure SDK Spoofing Vulnerability...

CVE-2024-21421

Azure SDK Spoofing Vulnerability (CVE-2024-21421) affects Microsoft Azure SDK. The connected sources describe a spoofing vulnerability in the Azure SDK that can be exploited remotely over the network with no user interaction and no privileges required, potentially allowing an attacker to spoof th...