4463 matches found
MinIO Information Disclosure (CVE-2023-28432)
Binary data minioCVE-2023-28432.nbin...
Rocky Linux 8 : .NET 8.0 (RLSA-2024:0150)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:0150 advisory. - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability CVE-2024-0056 - NET, .NET Framework, and...
AlmaLinux 8 : .NET 7.0 (ALSA-2024:0157)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:0157 advisory. - Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability CVE-2024-0056 - NET, .NET Framework, and Visu...
Microsoft SharePoint Exposed Web Services
Due to a misconfiguration in Microsoft SharePoint Server. An attacker with anonymous privileges can access to the SharePoint web services page. No source data...
GitLab 13.11 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39883)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : libssh vulnerability (USN-6561-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6561-1 advisory. Fabian Bumer, Marcus Brinkmann, Jrg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote...
A week in security (December 11 – December 17)
Last week on Malwarebytes Labs: PikaBot distributed via malicious search ads Chrome starts the countdown to the end of tracking cookies Apple to introduce new feature that makes life harder for iPhone thieves Recently-patched Apache Struts vulnerability used in worldwide attacks ALPHV ransomware...
AlmaLinux 9 : podman (ALSA-2023:7765)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7765 advisory. - Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA...
Fedora 38 : chromium (2023-3d9f7ca27f)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3d9f7ca27f advisory. update to 120.0.6099.109 - High CVE-2023-6702: Type Confusion in V8 - High CVE-2023-6703: Use after free in Blink - High CVE-2023-6704: Use after fr...
SUSE SLED15: xorg-x11-server / xorg-x11-server-extra / xorg-x11-server-sdk / etc (SUSE-SU-2023:4791-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4791-1 advisory. - CVE-2023-6377: Fixed out-of-bounds memory write in XKB button actions bsc1217765. -...
SUSE SLES12 Security Update : xorg-x11-server (SUSE-SU-2023:4790-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4790-1 advisory. - CVE-2023-6377: Fixed out-of-bounds memory write in XKB button actions bsc1217765. - CVE-2023-6478: Fixed out-of-bounds memory rea...
Vulnerability Scanner Detection Related to CVE-2023-38545
Veeam Backup & Replication 12.1.2 Release - Article Update With the release of Veeam Backup & Replication 12.1.2, the VDDK libraries, which contained the libcurl library, are no longer included with the Veeam Transport package. After upgrading, the Veeam Transport Package on remote components wil...
WordPress 6.4.x < 6.4.2 Remote Code Execution
According to its self-reported version number, the detected WordPress application is affected by a remote code execution vulnerability that is not directly exploitable in core, however there is a potential for high severity when combined with some plugins, especially in multisite installs. Note...
GHSA-WPFC-R5QQ-7R7P Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...
Jenkins NeuVector Vulnerability Scanner Plugin Cross-Site Request Forgery vulnerability
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...
Jenkins NeuVector Vulnerability Scanner Plugin missing permission check
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...
GHSA-PH87-4X2G-6HP4 Jenkins NeuVector Vulnerability Scanner Plugin missing permission check
Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier does not perform a permission check in a connection test HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...
CVE-2023-49673
A cross-site request forgery CSRF vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password...
CVE-2023-49674
A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified hostname and port using attacker-specified username and password...
CVE-2023-49673
A cross-site request forgery CSRF vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker-specified hostname and port using attacker-specified username and password...