PT-2022-3403

Name of the Vulnerable Software and Affected Versions Meridian Cooperative Utility Software versions 22.02 and 22.03 Description The issue is related to inadequate access control in the Meridian Cooperative Utility Software, allowing remote attackers to obtain sensitive user information, includin...

Malicious Package

Overview axp-utility-belt is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in adv-discord-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4bce6b056c243c50b7f0bb1396f9ab28c7d00fb6f6b0f2d957b5a5a31197a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-875 Malicious code in adv-discord-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4bce6b056c243c50b7f0bb1396f9ab28c7d00fb6f6b0f2d957b5a5a31197a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory for python-cookiecutter (FEDORA-2022-ff1c98b2fe)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

USN-5478-1 util-linux vulnerability

Christian Moch and Michael Gruhn discovered that the libblkid library of util-linux did not properly manage memory under certain circumstances. A local attacker could possibly use this issue to cause denial of service by consuming all memory through a specially crafted MSDOS partition table...

Amazon Linux AMI : xz (ALAS-2022-1598)

The version of xz installed on the remote host is prior to 5.2.2-1.14. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1598 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name...

UBUNTU-CVE-2022-31031

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions prior to and including 2.12.1 a stack buffer overflow vulnerability affects PJSIP users that use STUN in their...

Important: xz

Issue Overview: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to...

Important: gzip

Issue Overview: An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file name, this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to...

The Limits of Cyber Operations in Wartime

Interesting paper by Lennart Maschmeyer: "The Subversive Trilemma: Why Cyber Operations Fall Short of Expectations": Abstract: Although cyber conflict has existed for thirty years, the strategic utility of cyber operations remains unclear. Many expect cyber operations to provide independent utili...

Security Bulletin: Publicly disclosed vulnerability in GNU Binutils affects IBM Netezza Performance Server

Summary GNU Binutils is used by IBM Netezza Platform Server. IBM Netezza Platform Server has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2021-3549 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by an out-of-bounds flaw in the objdump utility. By persuadin...

GHSA-3VJC-5X79-M9R8 SilverStripe XXE Vulnerability in CSSContentParser

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity XXE attacks. When this developer utility is misused for purposes involving external or user submitted data in custom...

com.openshift.jenkins:openshift-pipeline (>=1.0.14, <=1.0.57), org.jenkins-ci.plugins.workflow:workflow-aggregator (1.11) +9 more potentially affected by CVE-2020-2109 via org.jenkins-ci.plugins.workflow:workflow-cps (1.11)

org.jenkins-ci.plugins.workflow:workflow-cps MAVEN version 1.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins.workflow:workflow-cps and may be impacted: - com.openshift.jenkins:openshift-pipeline =1.0.14, =1.3.0, =1.1.0, =1.1,...

gfix Red Database Unauthorized Access

The vulnerability of the gfix utility in the “Red Database” database management system is related to deficiencies in password masking during user login when the -f command is used as an argument passed to the utility. Exploiting this vulnerability can allow an attacker, operating remotely, to gai...

Malicious code in axp-utility-belt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 432021c8e0da8798e3783329a5a3ff6ec980b17267c665dc0c93d2e001a0e6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1214 Malicious code in axp-utility-belt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 432021c8e0da8798e3783329a5a3ff6ec980b17267c665dc0c93d2e001a0e6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

de.taimos:pipeline-aws (>=1.21, <=1.24), org.jenkins-ci.plugins:pipeline-utility-steps (>=2.0, <=2.0.2) potentially affected by CVE-2022-30946 via org.jenkins-ci.plugins:script-security (1.40)

org.jenkins-ci.plugins:script-security MAVEN version 1.40 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - de.taimos:pipeline-aws =1.21, =2.0, =2.0.2 Source cves: CVE-2022-30946 Source...

org.jenkins-ci.plugins:pipeline-utility-steps (>=1.4.0, <=1.5.1) potentially affected by CVE-2022-30946 via org.jenkins-ci.plugins:script-security (1.29.1)

org.jenkins-ci.plugins:script-security MAVEN version 1.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:pipeline-utility-steps =1.4.0, =1.5.1 Source cves:...

sscg bug fix and enhancement update

An update is available for sscg. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sscg utility helps to create more secure "self-signed" certificates. These...