GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: openbao-k8s, glow, kargo, docker-machine-driver-linode, scorecard, terraform-provider-kubernetes, haproxy-ingress, rabbitmq-messaging-topology-operator, spire-server, hubble, temporal-server, kube-bench, zot, sriov-network-device-plugin,...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: kots, ko-fips, prometheus-node-exporter-fips, gatus, victoriametrics-operator, kyverno, cue, crossplane-provider-aws-kinesis, opentelemetry-operator-fips, cluster-api-helm-controller, crossplane-provider-aws, ip-masq-agent, flux-kustomize-controller, trust-manager,...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2025-052)

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2025-052 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, includi...

Amazon Linux 2023 : freetype, freetype-demos, freetype-devel (ALAS2023-2025-925)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-925 advisory. An out of bounds write exists in FreeType versions 2.13.0 and below when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed...

Amazon Linux 2 : kernel (ALAS-2025-2826)

The version of kernel installed on the remote host is prior to 4.14.355-276.618. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2826 advisory. In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oombfqq CVE-2022-49179 ...

Amazon Linux 2 : libxslt (ALAS-2025-2823)

The version of libxslt installed on the remote host is prior to 1.1.28-6. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2823 advisory. xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes...

Amazon Linux 2 : golang (ALAS-2025-2825)

The version of golang installed on the remote host is prior to 1.23.8-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2825 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF...

Amazon Linux 2 : glibc (ALAS-2025-2828)

The version of glibc installed on the remote host is prior to 2.26-64. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2828 advisory. When the assert function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failur...

Amazon Linux 2 : thunderbird (ALAS-2025-2830)

The version of thunderbird installed on the remote host is prior to 128.8.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2830 advisory. There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2025-088 (ALASKERNEL-5.10-2025-088)

The version of kernel installed on the remote host is prior to 5.10.235-227.919. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2025-088 advisory. In the Linux kernel, the following vulnerability has been resolved: macsec: fix UAF bug for realdev...

WordPress plugin Amazon Showcase WordPress Plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2025-16998 · WordPress · Amazon Showcase Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Amazon Showcase WordPress Plugin versions n/a through 2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

Amazon Linux 2 : edk2 (ALAS-2025-2824)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2824 advisory. EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service. CVE-2025-229...

Amazon Linux 2 : containerd (ALASDOCKER-2025-055)

The version of containerd installed on the remote host is prior to 1.7.27-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2025-055 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including suppo...

Amazon Linux 2 : libxslt (ALAS-2025-2831)

The version of libxslt installed on the remote host is prior to 1.1.28-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2831 advisory. The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16....

Amazon Linux 2 : vim (ALAS-2025-2827)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2827 advisory. A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2025-053)

The version of docker installed on the remote host is prior to 25.0.8-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2025-053 advisory. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

Important: ghostscript

Issue Overview: Fix confusion between bytes and shorts. Data is being copied from a string in multiple of shorts, rather than multiple of bytes, leading to both a read probably benign, given the memory manager and write buffer overflow. Info: https://bugs.ghostscript.com/showbug.cgi?id=708131...

Medium: libxslt

Issue Overview: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information. CVE-2023-40403...

Medium: evolution

Issue Overview: An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary non-RFC6068 "mailto?attach=..." parameter, a website or other source of mailto links can make Evolution attach local files or directories to a composed email message without showing a warning to th...