MGASA-2022-0268 Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to version 103.0.5060.134 branch, fixing many bugs and 11 CVE. Some of them are listed below. Use after free in Guest View. CVE-2022-2477 Use after free in PDF. CVE-2022-2478 Insufficient validation of untrusted input in File. CVE-2022-2479 Use...

"Hulu" App for iOS vulnerable to improper server certificate verification

Overview "Hulu" App for iOS provided by HJ Holdings, Inc. is vulnerable to improper server certificate verification CWE-295. Shungo Kumasaka of GMO Cyber Security by IERAE reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

PT-2022-23755 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.2 Description: The issue concerns a missing email address validation in the "Git User Name Is Not Defined" dialog. This problem affects JetBrains IntelliJ IDEA. Recommendations: For versions prio...

PT-2022-7864 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions prior to 1.3.12 Description: The issue allows deactivated users to access messages when Single Sign-On SSO is enabled. Recommendations: For versions prior to 1.3.12, update to version 1.3.12 or later to resolve the issue...

PT-2022-7855 · Unknown · Kippo-Graph

Name of the Vulnerable Software and Affected Versions: kippo-graph versions prior to 1.5.1 Description: The issue is related to a cross-site scripting vulnerability in the xss clean function within class/KippoInput.class.php. Recommendations: For versions prior to 1.5.1, update to version 1.5.1 o...

SUSE-SU-2022:2568-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: apache-commons-csv: - Fix the URL for the package - Declare the LICENSE file as license and not doc apache-commons-math3: - Fix the URL for the package - Declare the LICENSE file as license and not doc drools: - Declare the LICENSE file as license and not d...

PT-2022-4028 · Compuware +1 · Jenkins Compuware Zadviser Api Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Compuware zAdviser API Plugin versions 1.0.3 and earlier Description: The issue is related to a flaw in the data protection mechanism of the Jenkins Compuware zAdviser API Plugin. This flaw can be exploited by a remote attacker to gai...

OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...

MGASA-2022-0265 Updated virtualbox packages fix security vulnerabilities

This update provides the upstream 6.1.36 maintenance release that fixes at least the following security vulnerabilities: A vulnerability in the Oracle VM VirtualBox prior to 6.1.36 contains an easily exploitable vulnerability that allows a high privileged attacker with logon to the infrastructure...

PT-2022-23358 · Scooter · Beyond Compare

Name of the Vulnerable Software and Affected Versions: Scooter Beyond Compare versions 1.8a through 4.4.2 Description: A DLL hijacking issue exists in the uninstaller when installed via the EXE installer. The uninstaller attempts to load DLLs from the Windows Temp folder. If a standard user place...

SUSE-SU-2022:2533-2 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: Various FIPS 140-3 related fixes were backported from SUSE Linux Enterprise 15 SP4: - Makes the PBKDF known answer test compliant with NIST SP800-132. bsc1192079. - FIPS: Add on-demand integrity tests through sftkFIPSRepeatIntegrityCheck...

KLA19261 XSS vulnerability in Apache Tomcat

Cross-site scripting XSS vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to perform cross-site scripting attack. Original advisories Apache Tomcat 9.x vulnerabilities Related products Apache-Tomcat CVE list CVE-2022-34305 high Solution Update to the latest...

PT-2022-20577 · Slack · Slack Morphism

Name of the Vulnerable Software and Affected Versions: Slack Morphism versions prior to 0.41.0 Description: The issue concerns the potential leakage of Slack OAuth client information into application debug logs due to insecure debug log formatting. This could lead to the accidental exposure of...

PT-2022-4001 · Oracle +2 · Virtualbox +2

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.36 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox. This can be exploited by a high-privileged attacker with logon access to the...

CVE-2022-31153 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts vanilla and ethereum flavors in the...

PT-2022-17572 · Terser +2 · Terser +2

Name of the Vulnerable Software and Affected Versions: terser versions prior to 4.8.1 terser versions 5.0.0 through 5.14.2 Description: The issue is related to a Denial of Service by Regular Expression ReDoS due to the insecure usage of regular expressions. This can lead to a service disruption...

SUSE-SU-2022:2359-1 Security update for squid

This update for squid fixes the following issues: - CVE-2021-46784: Fixed DoS when processing gopher server responses. bsc1200907 - Update to 5.6: - Improve handling of Gopher responses - Changes in 5.5: - fixes regression Bug 5192: esiparser default is incorrect - Bug 5177: clientca certificates...

PT-2022-20220 · Go +8 · Go +8

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.17.12 Go versions prior to 1.18.4 Description: The issue is related to uncontrolled recursion in Glob in io/fs, which allows an attacker to cause a panic due to stack exhaustion. This can be achieved by providing a path...

PT-2022-14118 · 3S Smart Software Solutions · Codesys Opc Da Server

Name of the Vulnerable Software and Affected Versions: CODESYS OPC DA Server versions prior to V3.5.18.20 Description: The issue concerns the storage of PLC passwords in plain text within the configuration file of the CODESYS OPC DA Server, making these passwords visible to all authorized Microso...

PT-2022-8921 · Dell · Dell Bsafe Crypto-C Micro Edition +1

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5 Dell BSAFE Micro Edition Suite versions prior to 4.6 Description: The issue is related to an Observable Timing Discrepancy, which may allow attackers to exploit the vulnerability...