18899 matches found
Oracle Linux 5 : setroubleshoot (ELSA-2008-0061)
The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0061 advisory. setroubleshoot: 2.0.5-3.0.1.el5 - replace missed references to bugzilla.redhat.com with linux.oracle.com 2.0.5-3 - Resolve: bug 436564: socket.getsocko...
Oracle Linux 7 : docker-engine / docker-cli (ELSA-2019-4827)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4827 advisory. docker-engine 19.03.1-1.0.0 - update to 19.03.1 19.03-0.0.1 - update to 19.03 Tenable has extracted the preceding description block directly from the...
Oracle Linux 7 : libqb (ELSA-2020-1189)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1189 advisory. 1.0.1-9 Also add OEXCL to logblackbox.c when creating files Resolves: rhbz1714853 1.0.1-8 Improve socket security Resolves: rhbz1714853 Tenable has extracted th...
Oracle Linux 5 : gfs2-utils (ELSA-2009-1337)
The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1337 advisory. 0.1.62-1 - Fix man page references to fsck.gfs2. - Resolves: rhbz477072 0.1.61-1 - fsck.gfs2 no longer segfaults when fixing 'EA leaf block type' problems. -...
Oracle Linux 5 : cman (ELSA-2009-1341)
The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-1341 advisory. 2.0.115-1 - RSA II fencing agent has been fixed. - Resolves: rhbz493802 2.0.114-1 - local variable 'verbosefilename' referenced before assignment has...
SUSE SLES15: glib2-devel / glib2-lang / glib2-tools / libgio-2_0-0 / etc (SUSE-SU-2023:3535-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3535-1 advisory. - CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files. bsc1183533 - CVE-2023-32665:...
SUSE: Security Advisory (SUSE-SU-2023:0174-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Arbitrary File Read
@tryghost/zip is vulnerable to Arbitrary File Read. The vulnerability exists because the module.exports function of extract.js does not properly restrict symbolic links in uploaded files, which allows an attacker to upload a symlink, leading to arbitrary files read on the operating system...
Debian dla-3535 : libunrar-dev - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3535 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3535-1 [email protected] https://www.debian.org/lts/security/...
Debian: Security Advisory (DLA-3535-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] [DLA 3535-1] unrar-nonfree security update
Debian LTS Advisory DLA-3535-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany August 17, 2023 https://wiki.debian.org/LTS Package : unrar-nonfree Version : 1:5.6.6-1+deb10u3 CVE ID : CVE-2022-48579 It was discovered that UnRAR, an unarchiver for rar files, allows...
CVE-2023-40028
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can...
Design/Logic Flaw
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can...
CVE-2023-40028
CVE-2023-40028 affects Ghost CMS versions prior to 5.59.1. The issue arises in the file upload mechanism where authenticated users can upload symlinks, enabling arbitrary file reads on the host (e.g., reading sensitive files outside the Ghost content directory). The primary documented impact is i...
CVE-2023-40028 Arbitrary file read via symlinks in Ghost
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can...
PT-2023-27222
Name of the Vulnerable Software and Affected Versions Ghost versions prior to 5.59.1 Description The issue allows authenticated users to upload files that are symlinks, which can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check...
UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
...
nodejs:16 security, bug fix, and enhancement update
nodejs 1:16.20.1-1 - Rebase to 16.20.1 Resolves: rhbz2188289 Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590 - Replace /usr/etc/npmrc symlink with builtin configuration Resolves: rhbz2222288 nodejs-nodemon nodejs-packaging...
