Critical: ipa

Issue Overview: A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM...

Amazon Linux 2 : ipa, --advisory ALAS2-2025-3026 (ALAS-2025-3026)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3026 advisory. A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While...

EUVD-2022-37227

Malicious code in bioql PyPI...

EUVD-2023-39807

Malicious code in bioql PyPI...

Amazon Linux 2 : cups, --advisory ALAS2-2025-3012 (ALAS-2025-3012)

The version of cups installed on the remote host is prior to 1.6.3-51. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3012 advisory. OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, ...

Amazon Linux 2 : libtiff, --advisory ALAS2-2025-3004 (ALAS-2025-3004)

The version of libtiff installed on the remote host is prior to 4.0.3-35. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3004 advisory. A flaw has been found in LibTIFF 4.7.0. This affects the function TIFFmallocExt/TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of t...

Amazon Linux 2 : GraphicsMagick, --advisory ALAS2GRAPHICSMAGICK1.3-2025-004 (ALASGRAPHICSMAGICK1.3-2025-004)

The version of GraphicsMagick installed on the remote host is prior to 1.3.45-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2GRAPHICSMAGICK1.3-2025-004 advisory. ReadJXLImage in JXL in GraphicsMagick before 1.3.46 lacks image dimension resource limits...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2025-1196)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1196 advisory. libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. CVE-2025-59375 Tenable has extracted the preceding...

Amazon Linux 2023 : openjpeg2, openjpeg2-devel, openjpeg2-tools (ALAS2023-2025-1198)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1198 advisory. openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. CVE-2025-50952 Tenable has extracted the preceding description block directly from the tested...

Amazon Linux 2023 : perl-Cpanel-JSON-XS (ALAS2023-2025-1199)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1199 advisory. Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact CVE-2025-40929...

Amazon Linux 2 : amazon-ssm-agent, --advisory ALAS2-2025-3010 (ALAS-2025-3010)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.3050.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3010 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line...

Amazon Linux 2 : openjpeg2, --advisory ALAS2-2025-3007 (ALAS-2025-3007)

The version of openjpeg2 installed on the remote host is prior to 2.4.0-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3007 advisory. openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. CVE-2025-50952 Tenable ha...

Amazon Linux 2023 : microcode_ctl (ALAS2023-2025-1209)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1209 advisory. Insufficient granularity of access control in the OOB-MSM for some IntelR XeonR 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent...

Amazon Linux 2 : thunderbird, --advisory ALAS2-2025-3008 (ALAS-2025-3008)

The version of thunderbird installed on the remote host is prior to 140.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3008 advisory. Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects Firefox 143,...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2025-1202)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1202 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which...

Amazon Linux 2 : ImageMagick, --advisory ALAS2-2025-3009 (ALAS-2025-3009)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3009 advisory. ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower...

Amazon Linux 2023 : iperf3, iperf3-devel (ALAS2023-2025-1197)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1197 advisory. In iperf before 3.19.1, iperfauth.c has an off-by-one error and resultant heap-based buffer overflow. CVE-2025-54349 In iperf before 3.19.1, iperfauth.c has a Base64Decode assertion failure an...

Amazon Linux 2023 : ruby3.2, ruby3.2-bundled-gems, ruby3.2-default-gems (ALAS2023-2025-1204)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1204 advisory. REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be...

Amazon Linux 2023 : cuda-cuobjdump-13 (ALAS2023NVIDIA-2025-143)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023NVIDIA-2025-143 advisory. Placeholder CVE. Details forthcoming CVE-2025-23280 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for th...

Amazon Linux 2 : dcraw, --advisory ALAS2-2025-3017 (ALAS-2025-3017)

The version of dcraw installed on the remote host is prior to 9.19-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3017 advisory. There is an integer overflow vulnerability in dcraw. When the victim runs dcraw with a maliciously crafted X3F input image, arbitrary...