Mageia: Security Advisory (MGASA-2023-0238)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Match 360 is vulnerable to CVE-2019-10202 and CVE-2019-10172 for jackson-mapper-asl

Summary Match 360 is vulnerable to the following CVEs: CVE-CVE-2019-10202 and CVE-2019-10172 Vulnerability Details CVEID:CVE-2019-10202 DESCRIPTION: Red Hat JBoss Enterprise Application Platform EAP could allow a remote attacker to execute arbitrary code on the system, caused by improper...

DEBIAN-CVE-2023-35934

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Gnome ibxml2 arbitrary code execution vulnerabilities( CVE-2022-40304, CVE-2022-40303)

Summary Potential Gnome ibxml2 arbitrary code execution vulnerabilities CVE-2022-40304, CVE-2022-40303 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-40304 DESCRIPTION: Gnome...

Security Bulletin: Denial of Service Vulnerability in Apache Solr used by IBM Operations Analytics - Log Analysis

Summary There is a potential denial of service in Apache Solr that is used by IBM Operations Analytics - Log Analysis Vulnerability Details IBM X-Force ID: 216835 DESCRIPTION: Apache Lucene is vulnerable to a denial of service. By sending a specific regular expression query, a remote attacker cou...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js glob-parent denial of service vulnerability( CVE-2021-35065)

Summary Potential Node.js glob-parent denial of service vulnerability CVE-2021-35065 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2021-35065 DESCRIPTION: Node.js glob-parent module...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js fast-csv modules denial of service vulnerability( CVE-2020-26256)

Summary Potential Node.js fast-csv modules denial of service vulnerability CVE-2020-26256 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2020-26256 DESCRIPTION: Node.js fast-csv...

Security Bulletin: IBM Watson Explorer is affected by a vulnerability in IBM WebSphere Application Server Liberty (CVE-2023-24998)

Summary IBM Watson Explorer contains a vulnerable version of IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2023-24998 DESCRIPTION: Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processe...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in TensorFlow [CVE-2023-25668]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in TensorFlow, caused by a heap-based buffer overflow. CVE-2023-25668 TensorFlow is included as part of the runtimes in our service. This vulnerabilitiy has been addressed. Please read the...

CVE-2023-2801

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public...

[SECURITY] [DLA 3436-2] sssd regression update

Debian LTS Advisory DLA-3436-2 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin May 31, 2023 https://wiki.debian.org/LTS Package : sssd Version : 1.16.3-3.2+deb10u2 sssd 1.16.3-3.2+deb10u1 DLA 3436-1 had a broken upgrade path from version 1.16.3-3.2. One could upgra...

Security Bulletin: IBM Cognos Command Center is vulnerable to a remote code execution vulnerability in Apache Commons Text (CVE-2022-42889)

Summary A remote code execution vulnerability in Apache Commons Text used by IBM Cognos Command Center was addressed. Vulnerability Details CVEID:CVE-2022-42889 DESCRIPTION: Apache Commons Text could allow a remote attacker to execute arbitrary code on the system, caused by an insecure...

Security Bulletin: IBM Security Verify Governance is vulnerable to cross-site scripting, caused by improper validation of user-supplied input related to the HtmlResponseWriter (CVE-2013-5855)

Summary IBM Security Verify Governance is vulnerable to cross-site scripting, caused by improper validation of user-supplied input related to the HtmlResponseWriter. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within...

Security Bulletin: Multiple vulnerabilities in the Linux kernel affect IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in the Linux Kernel affect IBM SAN Volume Controller, IBM Storwize V7000, V5000, V3700 and V3500, IBM Spectrum Virtualize Software, IBM Spectrum Virtualize for Public Cloud and IBM FlashSystem V9000 and 9100 family products. The applicable CVEs are CVE-2017-18017 and...

CVE-2014-125084 Gimmie Plugin trigger_referral.php sql injection

A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file triggerreferral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address th...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js json5

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Node.js json5. Vulnerability Details CVEID:CVE-2022-46175 DESCRIPTION: JSON5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a prototype pollution flaw...

Security Bulletin: Vulnerabilities in FasterXML affects IBM Common Licensing's Administration And Reporting Tool (ART) and its Agent (CVE-2022-42003, CVE-2022-42004)

Summary Security Vulnerablities have been addressed in IBM Common Licensing. Faster-XML Jackson is a JSON to Java object conversion API CVE-2022-42003, CVE-2022-42004. A fix is available to address the vulnerability. Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databi...

PT-2023-13702 · Ibm · Ibm Spectrum Virtualize

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Virtualize versions 7.8, 8.2, 8.3, 8.4, 8.5 Description: The issue could disclose sensitive information to an attacker using man-in-the-middle techniques under certain configurations. Recommendations: For versions 7.8, 8.2, 8.3,...

Google Chrome Security Update (stable-channel-update-for-desktop_25-2021-05) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Security Bulletin: A security vulnerability in Node.js shell-quote affects IBM Cloud Pak for Multicloud Management Managed Services [CVE-2021-42740]

Summary A security vulnerability in Node.js shell-quote affects IBM Cloud Pak for Multicloud Management Managed Services CVE-2021-42740, the fix removes Node.js shell-quote Vulnerability Details CVEID:CVE-2021-42740 DESCRIPTION: Node.js shell-quote module could allow a remote attacker to execute...