Security Bulletin: A Bouncy Castle vulnerability has been identified in Apache Solr and Logstash shipped with IBM Operations Analytics - Log Analysis (CVE-2023-33201)

Summary There is a potential injection vulnerability in Bouncy Castle that is used by Apache Solr and Logstash. This has been addressed Vulnerability Details CVEID:CVE-2023-33201 DESCRIPTION: The Bouncy Castle Crypto Package For Java bc-java could allow a remote attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities affect Apache Solr, Apache Zookeeper and Logstash shipped with IBM Operations Analytics - Log Analysis

Summary The following security issues have been identified in Netty component included as part of Apache Solr, Apache Zookeeper and Logstash product Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of...

Security Bulletin: Multiple vulnerabilities in Apache Solr, Apache Zookeeper and Logstash shipped with IBM Operations Analytics - Log Analysis (CVE-2023-43642, CVE-2023-34454, CVE-2023-34453, CVE-2023-34455)

Summary snappy-java in Apache Solr, Apache Zookeeper and Logstash is vulnerable to a denial of service. This has been addressed Vulnerability Details CVEID:CVE-2023-34454 DESCRIPTION: snappy-java is vulnerable to a denial of service, caused by an integer overflow in the compress function. By...

The vulnerability of the UriComponentsBuilder component in the Spring Framework’s URL analysis mechanism allows attackers to perform SSRF attacks.

The vulnerability of the UriComponentsBuilder component in the Spring Framework’s URL analysis module exists due to insufficient validation of data entered by users. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

MAL-2024-1108 Malicious code in mle-py-connector (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 91bb80bd9d7444d113ce05b2d2abac925c10e36a23ae955fd9ebd682cd046bd1 The OpenSSF Package Analysis project identified 'mle-py-connector' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

Security Bulletin: Log Analysis is susceptible to a vulnerability in Apache Solr

Summary There is jose4j vulnerability in Apache Solr. This has been addressed Vulnerability Details IBM X-Force ID: 254437 DESCRIPTION: Jose4J could allow a remote attacker to obtain sensitive information, caused by a chosen ciphertext attack in RSA15. By using cryptographic attack techniques, an...

Security Bulletin: Potential Vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis

Summary There is a potential XXE vulnerability in Apache Solr. This has been addressed. Vulnerability Details IBM X-Force ID: 261776 DESCRIPTION: Eclipse Jetty is vulnerable to server-side request forgery, caused by improper handling of XML external entity XXE declarations by the XmlParser. By...

Security Bulletin: Potential vulnerability in Eclipse Jetty used by Apache Solr affects IBM Operations Analytics - Log Analysis (CVE-2023-36479)

Summary Eclipse Jetty in Apache Solr could provide weaker than expected security. This has been addressed. Vulnerability Details CVEID:CVE-2023-36479 DESCRIPTION: Eclipse Jetty could provide weaker than expected security, caused by an errant command quoting flaw in the...

Security Bulletin: Vulnerability in Apache Solr, Apache Zookeeper and Logstash affect IBM Operations Analytics - Log Analysis (CVE-2023-34462)

Summary There is Netty vulnerability in Apache Solr, Apache Zookeeper and Logstash that effect IBM Operations Analytics - Log Analysis. These have been addressed Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up...

Security Bulletin: Eclipse Jetty vulnerability in Apache Solr and Apache ZooKeeper bundled with IBM Operations Analytics - Log Analysis (CVE-2023-26049)

Summary Information disclosure vulnerability in Eclipse Jetty that is used by Apache Solr and Apache ZooKeeper. Log Analysis has addressed the vulnerability Vulnerability Details CVEID:CVE-2023-26049 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker to obtain sensitive...

Security Bulletin: A vulnerability has been identified in Apache Solr and Apache Zookeeper shipped with IBM Operations Analytics - Log Analysis (CVE-2023-26048)

Summary There is a potential vulnerability in Eclipse Jetty that is used by Apache Solr and Apache ZooKeeper. This has been addressed Vulnerability Details CVEID:CVE-2023-26048 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the...

Security Bulletin: Vulnerability in Apache Solr affects IBM Operations Analytics - Log Analysis (CVE-2023-40167)

Summary There is a potential HTTP request smuggling vulnerability in Apache Solr. This has been addressed. Vulnerability Details CVEID:CVE-2023-40167 DESCRIPTION: Jetty is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP/1 request header. By sending a specially crafted...

Security Bulletin: Google Guava vulnerability in Apache Solr and Logstash bundled with IBM Operations Analytics - Log Analysis (CVE-2023-2976)

Summary There is an information disclosure vulnerability in Google Guava that is used by Apache Solr and Logstash. This has been addressed Vulnerability Details CVEID:CVE-2023-2976 DESCRIPTION: Google Guava could allow a local authenticated attacker to obtain sensitive information, caused by a fl...

Security Bulletin: Vulnerability in Apache Solr affect IBM Operations Analytics - Log Analysis (CVE-2023-50290)

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr Vulnerability Details CVEID:CVE-2023-50290 DESCRIPTION: Apache Solr could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation. By sending ...

Malicious code in soundcloud-scrape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49aa7d872acd9b91dd62d1aec545292c8d638126b53eadcc46435726c1c4215a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in geico_design_kit2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fb947e32f21c9faa279b825aa5989d3a6fcbe09de00409c630dd824dc5ce42f0 The OpenSSF Package Analysis project identified 'geicodesignkit2' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1098 Malicious code in geico_design_kit2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fb947e32f21c9faa279b825aa5989d3a6fcbe09de00409c630dd824dc5ce42f0 The OpenSSF Package Analysis project identified 'geicodesignkit2' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

RedCurl Cybercrime Group Abuses Windows PCA Tool for Corporate Espionage

The Russian-speaking cybercrime group called RedCurl is leveraging a legitimate Microsoft Windows component called the Program Compatibility Assistant PCA to execute malicious commands. "The Program Compatibility Assistant Service pcalua.exe is a Windows service designed to identify and address...

Softing edgeConnector

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION : Low attack complexity Vendor : Softing Equipment : edgeConnector Vulnerabilities : Cleartext Transmission of Sensitive Information, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities could create conditions...

Fortinet FortiPortal Authorization Issues Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. An authorization issue vulnerability exists in Fortinet FortiPortal that stems from the...