SUSE-SU-2023:2637-1 Security update for sccache

This update for sccache fixes the following issues: - CVE-2023-1521: Fixed possible code injection via LDPRELOAD to sccache server bsc1212407. - CVE-2022-31394: Fixed a denial-of-service vulnerability via header list size bsc1208553...

SUSE-SU-2023:2620-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2023-1255: Fixed input buffer over-read in AES-XTS implementation on 64 bit ARM bsc1210714. - CVE-2023-2650: Fixed possible DoS translating ASN.1 object identifiers bsc1211430...

CVE-2023-32463

Dell VxRail, versions 8.0.100 and earlier contain a denial-of-service vulnerability in the upgrade functionality. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to degraded performance and system malfunction...

CVE-2023-34673

Elenos ETG150 FM transmitter running on version 3.12 was discovered to be leaking SMTP credentials and other sensitive information by exploiting the publicly accessible Memcached service. The attack can occur over the public Internet in some cases...

Design/Logic Flaw

An issue in the reldeps component of MonetDB Server v11.45.17 and v11.46.0 allows attackers to cause a Denial of Service DoS via crafted SQL statements...

The vulnerability of the XCP Authentication service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) allows a perpetrator to cause a service failure.

The vulnerability of the XCP Authentication service in the Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P system is related to insufficient validation of user input data. Exploiting this vulnerability allows a malicious actor to trigger a service failure by sending a...

Heap overflow

A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copynstr in the file mqttparser.c. An attacker could exploit this vulnerability to cause a denial of service attack...

CVE-2023-34969

D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon...

CVE-2023-34969

CVE-2023-34969 affects the dbus package. D-Bus before 1.15.6 may allow an unprivileged user to crash dbus-daemon when a privileged user uses org.freedesktop.DBus.Monitoring to observe traffic; on the system bus this yields a denial-of-service. Affected versions are before 1.15.6; fixed in 1.12.28...

CVE-2022-31693

VMware Tools for Windows 12.x.y prior to 12.1.5, 11.x.y and 10.x.y contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a...

CVE-2023-34411

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service panic via an invalid ! token such as !DOCTYPEs/%!A nesting in an XML document. The earliest affected version is 0.8.9...

Fedora 37 : bitcoin-core (2023-3317c9b824)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3317c9b824 advisory. Update to version 24.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

GIT suffers from a service parameter injection vulnerability

GIT is a revision control system. GIT suffers from a service parameter injection vulnerability that can be exploited by an attacker to execute arbitrary code from a distance...

SUSE-SU-2023:2296-1 Security update for openvswitch

This update for openvswitch fixes the following issues: - CVE-2023-1668: Fixed remote traffic denial of service via crafted packets with IP proto 0 bsc1210054...

CVE-2023-28413

Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated attacker to obtain sensitive information, alter the website, or cause a denial-of-service DoS condition...

CVE-2023-31994

Certain Hanwha products are vulnerable to Denial of Service DoS. ck vector is: When an empty UDP packet is sent to the listening service, the service thread results in a non-functional service DoS via WS Discovery and Hanwha proprietary discovery services. This affects IP Camera ANE-L7012R 1.41.0...

CVE-2023-32350

Versions 00.07.00 through 00.07.03 of Teltonika’s RUT router firmware contain an operating system OS command injection vulnerability in a Lua service. An attacker could exploit a parameter in the vulnerable function that calls a user-provided package name by instead providing a package with a...

Cisco Small Business Denial of Service Vulnerability (CNVD-2023-40906)

Cisco Small Business is a switch from the American company Cisco Cisco. A denial of service vulnerability exists in Cisco Small Business Series Switches, which arises from a device authentication error on requests sent to the web interface, and can be exploited by an unauthenticated, remote...

Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to a denial of service vulnerability in JXPath (CVE-2022-40161)

Summary IBM InfoSphere Information Server is affected but not classified as vulnerable to a denial of service vulnerability in JXPath. The CVE is addressed. Vulnerability Details CVEID:CVE-2022-40161 DESCRIPTION: JXPath is vulnerable to a denial of service, caused by a stack-based buffer overflow...

JerryScript ecma_big_uint_div_mod function denial of service vulnerability

JerryScript is a lightweight JavaScript engine Jerryscript project . A denial of service vulnerability exists in the JerryScript ecmabiguintdivmod function, which can be exploited by an attacker to cause a denial of service...