Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2024-472)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-472 advisory. This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies tha...

Amazon Linux 2023 : tar (ALAS2023-2024-475)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-475 advisory. It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to crash, resulting in a denial of service...

Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2024-466)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-466 advisory. NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry. CVE-2023-50495 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2023 : gnutls, gnutls-c++, gnutls-dane (ALAS2023-2024-463)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-463 advisory. A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding. Only TLS ciphertext...

Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2024-465)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-465 advisory. The upstream bug report describes this issue as follows:A flaw was found in Ansible, where a user's controller is vulnerable to template injection when internal templating operations may errantly remove...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2024-464)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-464 advisory. Certain aggregate function calls receiving unknown-type arguments could disclose bytes of server memory from the end of the unknown-type value to the next zero byte. One typically gets an...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2024-477)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-477 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP clie...

Amazon Linux 2023 : ecs-init (ALAS2023-2024-476)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-476 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Tenable has extracted the precedi...

Auto Amazon Links < 5.1.2 - Contributor+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user...

CVE-2024-21634

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then...

Design/Logic Flaw

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then...

CVE-2024-21634

CVE-2024-21634 is a DoS in Amazon Ion’s Java implementation (ion-java) prior to 1.10.5, triggered when deserializing Ion text/binary data into IonValue and invoking certain IonValue methods, leading to StackOverflowError. The issue is fixed in ion-java 1.10.5. In Jira Software Data Center/Server,...

CVE-2024-21634 Ion Java StackOverflow vulnerability

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then...

CVE-2024-21634 Ion Java StackOverflow vulnerability

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in ion-java for applications that use ion-java to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the IonValue model and then...

Amazon Ion Security Breach

Amazon Ion is a type-rich, self-describing, hierarchical data serialization format from Amazon Amazon. It provides interchangeable binary and textual representations. A security vulnerability exists in Amazon Ion versions prior to 1.10.5, which stems from a stack overflow in Ion Java that could...

WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Auto Amazon Links Type Plugin Vulnerable versions = 5.1.1 Fixed in 5.1.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-52175 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f072a5fa406e Credits Nguyen Anh Tien Required privilege...

CVE-2023-51651

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK f...

Path traversal

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK f...

UBUNTU-CVE-2023-51651

AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the buildEndpoint method in the RestSerializer component of the AWS SDK f...

CVE-2023-51651

The CVE-2023-51651 issue affects AWS SDK for PHP (v3) prior to 3.288.1. The vulnerability resides in the RestSerializer’s buildEndpoint, which relies on Guzzle Psr7 UriResolver that strips dot segments per RFC 3986. Under certain conditions, this can lead to a path traversal in S3 object key pref...