RXSA-2023:0951 Important: kernel security and bug fix update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use-after-free caused by l2capreassemblesdu in net/bluetooth/l2capcore.c CVE-2022-3564 kernel: stack overflow in doprocdointvec and procskipspaces CVE-2022-4378 kernel: use-after-free in...

IBM Security Guardium Key Lifecycle Manager Unauthorized Access Vulnerability

IBM Security Guardium Key ifecycle Manager is managing the encryption key management process through centralization, streamlining and automation to help protect encrypted data and simplify encryption key management. vulnerability. The vulnerability is due to the fact that the affected version can...

CVE-2023-20113

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management...

Adobe Dimension out-of-bounds read vulnerability (CNVD-2023-27689)

Adobe Dimension is a set of 2D and 3D composite design tools from Adobe, Inc. An out-of-bounds read vulnerability exists in Adobe Dimension, which can be exploited by attackers to execute arbitrary code on the system...

Adobe Dimension Out-of-Bounds Read Vulnerability (CNVD-2023-41414)

Adobe Dimension is a set of 2D and 3D composite design tools from the American company Audobee Adobe. Adobe Dimension suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

Adobe Dimension Out-of-Bounds Read Vulnerability (CNVD-2023-41416)

Adobe Dimension is a set of 2D and 3D composite design tools from the American company Audobee Adobe. Adobe Dimension suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute arbitrary code on the system...

Microsoft SQL Server 2014 / 2016 / 2017 / 2019 / 2022 Audit Logging Failure Vulnerability

Microsoft SQL Server 2014, 2016, 2017, 2019, and 2022 appears to ignore audit rules for sys.sysxlgns allowing an attacker with administrative permissions to extract password hashes under the radar. Microsoft told the researcher they are not willing to fix it but acknowledge it as a security...

Microsoft SQL Server 2014 / 2016 / 2017 / 2019 / 2022 Audit Logging Failure

Title: Microsoft SQL Server Password Hash Exposure Product: Database Manufacturer: Microsoft Affected Versions: 2012-2022 Risk Level: Medium CVE Reference: N/A Author of Advisory: Emad Al-Mousa Overview: SQL Server is a popular database system, and database systems are a vital backbone in IT...

Answer Cross-Site Scripting Vulnerability (CNVD-2023-31162)

Answer is an open source knowledge-based community software. You can quickly use it to build Q&A communities for your products, customers, teams and more. Answer has a cross-site scripting vulnerability in versions prior to 1.0.6. The vulnerability stems from the fact that when answering added ne...

CVE-2023-22756

CVE-2023-22756 corresponds to buffer overflow vulnerabilities in ArubaOS processes that allow unauthenticated remote code execution when specially crafted packets are sent via the PAPI protocol. Affected product family: ArubaOS (Aruba Mobility Controllers/ gateways). Root cause described as buffe...

Remote Code Execution (RCE)

apacheairflowprovidersapachehive is vulnerable to Remote Code Execution RCE. The vulnerability exists due to the prepareclicmd function in hive.py because the hive beeline parameters are not properly validated, which allows an attacker to upload and execute malicious code on the system...

K15172: BIND vulnerability CVE-2010-3762

Security Advisory Description Description ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service daemon crash via a DNS query...

K89621551: OpenSSH vulnerability CVE-2017-15906

Security Advisory Description The processopen function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. CVE-2017-15906 Impact BIG-IP, BIG-IQ, F5 iWorkflow, Enterprise Manager, LineRate, and ARX...

Design/Logic Flaw

IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 246333...

SUSE CVE-2010-0014

System Security Services Daemon SSSD before 1.0.1, when the krb5 authprovider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting...

SUSE CVE-2010-4341

The pamparseindatav2 function in src/responder/pam/pamsrvcmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service infinite loop, crash, and login prevention via a crafted packet...

SUSE CVE-2011-1758

The krb5saveccnamedone function in providers/krb5/krb5auth.c in System Security Services Daemon SSSD 1.5.x before 1.5.7, when automatic ticket renewal and offline authentication are configured, uses a pathname string as a password, which allows local users to bypass Kerberos authentication by...

SUSE CVE-2013-0219

System Security Services Daemon SSSD before 1.9.4, when 1 creating, 2 copying, or 3 removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files...

SUSE CVE-2013-0287

The Simple Access Provider in System Security Services Daemon SSSD 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simpledenygroups option, which allows remote authenticated users to bypass intended access restrictions...

SUSE CVE-2015-5292

Memory leak in the Privilege Attribute Certificate PAC responder plugin sssdpacplugin.so in System Security Services Daemon SSSD 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service memory consumption via a large number of logins that trigger parsing of PAC blobs duri...