435 matches found
SUSE-SU-2026:22157-1 Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues Update to version 3.3.4624.0: - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh bsc1239342. - CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs bsc1238702. ...
amazon-ssm-agent-3.3.4624.0-2.1 on GA media (moderate)
amazon-ssm-agent-3.3.4624.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:10966-1 Rating: moderate Cross-References: CVE-2026-39827 CVE-2026-39828 CVE-2026-39834 CVE-2026-46598 CVSS scores: CVE-2026-39827 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2026-39827 SUSE : 7.1...
Important: amazon-ssm-agent
Issue Overview: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. CVE-2026-33814 Affected Packages: amazon-ssm-agent Issue Correction: Run dnf update amazon-ssm-agent --releasever...
OPENSUSE-SU-2026:10966-1 amazon-ssm-agent-3.3.4624.0-2.1 on GA media
These are all security issues fixed in the amazon-ssm-agent-3.3.4624.0-2.1 package on the GA media of openSUSE Tumbleweed...
Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2026-1813)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1813 advisory. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. CVE-2026-33814 Tenable has extracte...
Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2026-3350 (ALAS-2026-3350)
The version of amazon-ssm-agent installed on the remote host is prior to 3.3.4515.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3350 advisory. When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it...
Important: amazon-ssm-agent
Issue Overview: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0. CVE-2026-33814 Affected Packages: amazon-ssm-agent Note: This advisory is applicable to Amazon Linux 2 AL2 Core...
amazon-ssm-agent-3.3.4624.0-1.1 on GA media (moderate)
amazon-ssm-agent-3.3.4624.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10943-1 Rating: moderate Cross-References: CVE-2026-44740 CVSS scores: CVE-2026-44740 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-44740 SUSE : 8.7...
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...
OPENSUSE-SU-2026:10943-1 amazon-ssm-agent-3.3.4624.0-1.1 on GA media
These are all security issues fixed in the amazon-ssm-agent-3.3.4624.0-1.1 package on the GA media of openSUSE Tumbleweed...
amazon-ssm-agent-3.3.4515.0-1.1 on GA media (moderate)
amazon-ssm-agent-3.3.4515.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10872-1 Rating: moderate Cross-References: CVE-2026-39821 CVSS scores: CVE-2026-39821 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2026-39821 SUSE : 9.1...
CVE-2026-38808
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...
OPENSUSE-SU-2026:10872-1 amazon-ssm-agent-3.3.4515.0-1.1 on GA media
These are all security issues fixed in the amazon-ssm-agent-3.3.4515.0-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-38808
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...
PT-2026-44049
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...
CVE-2026-38808: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...
CVE-2026-38808
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...
CVE-2026-38808
SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java components...
CVE-2026-38808
The uyz-ssm-mall (Yuzu Cloud E-commerce Mall) software, an SSM framework used for creating e-commerce stores and customer management systems, is vulnerable to SQL Injection in version v1.1.0 . The root cause lies within the ProductMapper.xml and /OrderUtil.java components. This vulnerability allo...
CVE-2026-42526
In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a connid containing a / e.g. "myteam/conn" to the same path as another team's team-scoped secret when the caller had no team context. A...