Security Bulletin: IBM Rational Build Forge 8.0.0.25 addresses multiple vulnerabilities

Summary IBM Rational Build Forge 8.0.0.25 addresses multiple vulnerabilities Vulnerability Details CVEID:CVE-2023-42794 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service, caused by accumulation of temporary files on Windows when a web application opened a stream for an uploaded file...

SUSE-SU-2023:4550-1 Security update for fdo-client

This update for fdo-client fixes the following issues: - Removed build key via utils/keysgen.sh. bsc1216293...

SUSE-SU-2023:4549-1 Security update for fdo-client

This update for fdo-client fixes the following issues: - Removed build key via utils/keysgen.sh. bsc1216293...

SUSE-SU-2023:4548-1 Security update for fdo-client

This update for fdo-client fixes the following issues: - Removed build key via utils/keysgen.sh. bsc1216293...

SUSE-SU-2023:4547-1 Security update for fdo-client

This update for fdo-client fixes the following issues: - Removed build key via utils/keysgen.sh. bsc1216293...

PT-2023-36293 · Unknown · Fdo-Client

Name of the Vulnerable Software and Affected Versions: fdo-client affected versions not specified Description: The issue concerns the removal of a build key via utils/keys gen.sh. No information is provided about the estimated number of potentially affected devices or real-world incidents where...

PT-2023-36291 · Unknown · Fdo-Client

Name of the Vulnerable Software and Affected Versions: fdo-client affected versions not specified Description: The issue concerns the removal of a build key via utils/keys gen.sh. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

PT-2023-36292 · Unknown · Fdo-Client

Name of the Vulnerable Software and Affected Versions: fdo-client affected versions not specified Description: The issue concerns the removal of a build key via utils/keys gen.sh. No information is provided about the estimated number of potentially affected devices or real-world incidents where...

PT-2023-36294 · Unknown · Fdo-Client

Name of the Vulnerable Software and Affected Versions: fdo-client affected versions not specified Description: The issue concerns the removal of a build key via utils/keys gen.sh. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

Malicious code in build-buf-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a304d66d7773527e0729b9cd85dabce6d67e562734ee2297be4fac9ffd6be8b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8552 Malicious code in build-buf-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a304d66d7773527e0729b9cd85dabce6d67e562734ee2297be4fac9ffd6be8b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2023:4496-1 Security update for libreoffice

This update for fixes the following issues: libreoffice was updated rom 7.5.4.1 to 7.6.2.1 jscPED-6799, jscPED-6800: - For the highlights of changes of version 7.6 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.6 - You can check for each minor releas...

PT-2023-8887 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-rev617-g671976fcc-master Description: The issue is related to a memory leak in the extract attributes function, located in media tools/m3u8.c:329, which can lead to a denial of service. This is due to the lack of memory...

OPENSUSE-SU-2023:0374-1 Security update for yt-dlp

This update for yt-dlp fixes the following issues: - Update to release 2023.11.14 Security: CVE-2023-46121 Patch Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection Disallow smuggling of arbitrary httpheaders; extractors now only use specific headers - Make yt-dlp require the one...

Security update for yt-dlp (moderate)

openSUSE Security Update: Security update for yt-dlp Announcement ID: openSUSE-SU-2023:0374-1 Rating: moderate References: 1213124 1216467 Cross-References: CVE-2023-35934 CVE-2023-46121 CVSS scores: CVE-2023-35934 NVD : 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N Affected Products: openSUSE...

Sensitive Information Disclosure

io.quarkus io.quarkus.gradle.plugin is vulnerable to Information Disclosure. The vulnerability is due improper sanitization of artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information...

jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin

A flaw was found in the Jenkins pipeline-build-step plugin. Affected versions of the pipeline-build-step plugin do not escape job names in a JavaScript expression used in the Pipeline Snippet Generator. This can result in a stored cross-site scripting XSS vulnerability that may allow attackers to...

GHSA-P62Q-5483-H57V Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...

Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...

CVE-2023-5720

A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...