SUSE CVE-2022-3697

A flaw was found in Ansible in the amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs...

The vulnerability of Juniper Networks Junos operating systems’ HTTP/HTTPS services allows attackers to execute arbitrary code.

The vulnerability of Juniper Networks Junos operating systems’ HTTP/HTTPS services exists due to incorrect pathname restrictions for access to restricted directories. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Redpanda 安全漏洞

Redpanda is a streaming data platform for developers. It is compatible with the Kafka API. A security vulnerability exists in Redpanda versions prior to 22.3.12 that stems from exposing plaintext AWS credentials, which can be exploited by a local attacker to view keys in the console or logs...

IBM WebSphere Application Server encryption problem vulnerability

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. IBM WebSphere Application Server versions 8.5 and 9.0 ha...

IBM WebSphere Application Server Code Injection Vulnerability

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform.A code injection vulnerability exists in IBM WebSphere...

Guide to Container Management on AWS

This article explores how services provided by Amazon Web Services enable better container management with simplicity, flexibility, and complete control...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

The vulnerability of the XML security component of the Oracle Web Services Manager application on the Oracle Fusion Middleware software platform allows a perpetrator to gain unauthorized access to protected data or to modify, add, or delete protected data.

The vulnerability of the XML Security component of the Oracle Web Services Manager application in the Oracle Fusion Middleware software platform is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected data o...

CXF: SSRF Vulnerability

A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...

CVE-2023-21862

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware component: XML Security component. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web...

Oracle Web Services Manager 安全漏洞

Oracle Web Services Manager OWSM is a service manager from Oracle Corporation that provides a policy framework for consistently managing and securing Web services across an organization. A security vulnerability exists in Oracle Web Services Manager version 12.2.1.4.0. An unauthenticated attacker...

CVE-2023-21862

CVE-2023-21862 affects Oracle Web Services Manager (OWSM) within Oracle Fusion Middleware, specifically the XML Security component in version 12.2.1.4.0. The issue stems from insufficient input validation, enabling an unauthenticated attacker with network access via HTTP to compromise OWSM, poten...

PT-2023-1241 · Oracle · Oracle Web Services Manager

Name of the Vulnerable Software and Affected Versions: Oracle Web Services Manager version 12.2.1.4.0 Description: The issue is related to insufficient input validation in the XML Security component of Oracle Web Services Manager, part of Oracle Fusion Middleware. This easily exploitable flaw...

Vulnerability of the web service of Google Chrome and Microsoft Edge, allowing a hacker to execute arbitrary code

The vulnerability of the Google Chrome and Microsoft Edge browser services is related to type conversion errors. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

USN-5802-1: Linux kernel vulnerabilities

It was discovered that the NFSD implementation in the Linux kernel did not properly handle some RPC messages, leading to a buffer overflow. A remote attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-43945 Tamás Koczka discovered that th...

Siemens SINEC NMS 路径遍历漏洞

SINEC INS Infrastructure Network Services is a web-based application that combines various network services in a single tool. This simplifies the installation and management of all network services related to industrial networks.A path traversal vulnerability exists in Siemens SINEC INS, which...

Security Bulletin: IBM Connect:Direct Web Services vulnerable to sensitive information exposure due to PostgreSQL (CVE-2022-41946)

Summary IBM Connect:Direct Web Services has addressed a PostgreSQL vulnerability. Vulnerability Details CVEID:CVE-2022-41946 DESCRIPTION: Postgresql JDBC could allow a local authenticated attacker to obtain sensitive information, caused by not limit access to created readable files in the...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to denial of service due to FasterXML jackson-databind (CVE-2022-42004)

Summary IBM Sterling Connect:Direct Web Services has addressed a denial of service vulnerability due to FasterXML jackson-databind. Vulnerability Details CVEID:CVE-2022-42004 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in in the...

PT-2023-12722 · Spinnaker +2 · Spinnaker +2

Name of the Vulnerable Software and Affected Versions: Spinnaker's Rosco microservice versions prior to 1.29.2, 1.28.4, and 1.27.3 Description: Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine...