11560 matches found
CVE-2023-5720 Quarkus: build env information disclosure via gradle plugin
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...
CVE-2023-5720 Quarkus: build env information disclosure via gradle plugin
A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain. This flaw allows an attacker to access potentially sensitive information from the build system within the application...
ManageEngine SupportCenter Plus < 14.2 Build 14200
The version of ManageEngine SupportCenter Plus installed on the remote host is prior to 14.2 Build 14200. It is, therefore, affected by a vulnerability as referenced in the support-centerCVE-2023-38331 advisory. - Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS i...
Quarkus Security Vulnerabilities
Quarkus is a cloud-native Linux container-first framework for writing Java applications. A security vulnerability exists in Quarkus that stems from not properly cleaning artifacts created using the Gradle plugin, which allows for the retention of certain build system information, allowing an...
golang: cmd/go: line directives allows arbitrary execution during build
A flaw was found in the golang cmd/go standard library. A line directive "//line" can be used to bypass the restrictions on "//go:cgo" directives, allowing blocked linker and compiler flags to pass during compilation. This can result in the unexpected execution of arbitrary code when running "go...
November 14, 2023—Hotpatch KB5032304 (OS Build 20348.2091)
None None...
Design/Logic Flaw
Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch...
CVE-2023-42816 Denial of service from malicious signature in kyverno
Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch...
c-ares: AutoTools does not set CARES_RANDOM_FILE during cross compilation
A flaw was found in c-ares. This issue occurs when cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross-compiling aarch64 android. As a result, it will downgrade to rand, which could allow an attacker to utilize the lack of entropy by no...
RUSTSEC-2023-0104 `littest` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...
`tiny-server` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...
RUSTSEC-2023-0114 `tiny-server` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...
Security Bulletin: Due to use of Netty, IBM® MobileFirst Platform is vulnerable to a denial of service.
Summary Netty is used by IBM® MobileFirst Platform. CVE-2023-34462 Vulnerability Details CVEID:CVE-2023-34462 DESCRIPTION: Netty is vulnerable to a denial of service, caused by a flaw with allocating up to 16MB of heap for each channel during the TLS handshake the SniHandler class. By sending a...
Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2023-420)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-420 advisory. An issue was found in libcurl which allows cookies to be inserted into a running program if specific conditions are met. The libcurl provided function, curleasyduphandle, is used to duplicate t...
Security Bulletin: IBM® Db2® is vulnerable to an information disclosure vulnerability due to the consumed GSKit library (CVE-2023-32342)
Summary IBM® Db2® is vulnerable to an information disclosure vulnerability due to the consumed GSKit library. The fix for this issue was already published in an earlier bulletin. If you have already applied the appropriate Db2 special build or installed GSKit version 8.0.55.31, which contains the...
CVE-2023-5625
A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products...
CVE-2023-5625
A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products...
PT-2023-7172 · Unknown +1 · Python-Eventlet +1
Name of the Vulnerable Software and Affected Versions: python-eventlet affected versions not specified Description: The issue is related to incorrect cleanup or release of resources in the python-eventlet library of the OpenStack Platform. This could allow a remote attacker to cause a denial of...
Eventlet Security Vulnerabilities
Eventlet is a concurrent networking library for Python. There is a security vulnerability in python-eventlet that stems from a regression introduced in the Red Hat build version that resulted in patches not being applied to all versions of all products...