[SECURITY] Fedora 41 Update: iniparser-4.2.4-3.fc41

iniParser is an ANSI C library to parse "INI-style" files, often used to hold application configuration information...

The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series systems arises from errors in system configuration or setup. This vulnerability allows attackers to gain unauthorized access to application configuration information.

The vulnerability of microprogramming software in embedded network control controllers of ASPECT Enterprise, NEXUS Series, and MATRIX Series is related to errors in system configuration or setup. Exploiting this vulnerability can allow an attacker to gain unauthorized access to application...

GHSA-W8GC-X259-RC7X rails-html-sanitize has XSS vulnerability with certain configurations

Summary There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0 and Nokogiri = 1.16.8. Impact A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5...

rails-html-sanitizer has XSS vulnerability with certain configurations

Summary There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. Versions affected: 1.6.0 Not affected: 1.6.0 Fixed versions: 1.6.1 Impact A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2024-006)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2OPENSSL-SNAPSAFE-2024-006 advisory. Issue summary: Calling the OpenSSL API function SSLselectnextproto with anempty supported client protocol...

CVE-2024-2502

An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected. This is possible because the TAMPERRSTCAUSE register may not be properly updated when a level 4 tamper event a tamper reset occurs. This impacts Series 2 HSE-SVH...

CVE-2024-36075

The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due to the way an archive obtained from the Endpoint Protector or Unify server is extracted on the endpoint. An attacker who is able to modify the archive on the...

CVE-2024-36075

The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due to the way an archive obtained from the Endpoint Protector or Unify server is extracted on the endpoint. An attacker who is able to modify the archive on the...

CVE-2024-36075

CoSoSys Endpoint Protector (versions 5.9.3 and earlier) and Unify agent (versions 7.0.6 and earlier) are susceptible to an arbitrary code execution vulnerability. The root cause lies in the insecure way an archive obtained from the Endpoint Protector or Unify server is extracted on the endpoint. ...

Malicious code in application-config (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

The vulnerability of the Import Certificate function in the Nginx UI server’s user interface allows a perpetrator to gain access to read, modify, and delete data, as well as execute arbitrary code.

The vulnerability of the Import Certificate function in the Nginx UI server’s user interface is related to incorrect restrictions on the path names for sslcertificatepath, sslcertificatekeypath, sslcertificate, and sslcertificatekey, which have limited access. Exploiting this vulnerability could...

Design/Logic Flaw

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805...

CVE-2023-40691 IBM Cloud Pak for Business Automation information disclosure

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator users. IBM X-Force ID: 264805...

CVE-2021-32050

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed. Without due care, an application may...

CVE-2023-21409

Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application...

CVE-2023-21409

Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application...

Authorization

Due to insufficient file permissions, unprivileged users could gain access to unencrypted administrator credentials allowing the configuration of the application...

CVE-2023-21409

CVE-2023-21409: The issue is described as insufficient file permissions that allow unprivileged users to access unencrypted administrator credentials and configure the application. The Red Hat entry reiterates this description. No concrete remediation, affected product/version specifics, exploit ...

CVE-2023-1862

Cloudflare WARP client for Windows up to v2023.3.381.0 allowed a malicious actor to remotely access the warp-svc.exe binary due to an insufficient access control policy on an IPC Named Pipe. This would have enabled an attacker to trigger WARP connect and disconnect commands, as well as obtaining...

CVE-2023-1862

CVE-2023-1862 affects the Cloudflare WARP client for Windows (up to v2023.3.381.0). The weakness is an insufficient access control policy on an IPC Named Pipe used by warp-svc.exe, which could let a remote attacker trigger WARP connect/disconnect commands and read network diagnostics and applicat...