CVE-2022-45397

CVE-2022-45397 : Jenkins OSF Builder Suite — XML Linter Plugin (versions 1.0.2 and earlier) is vulnerable to XML External Entity (XXE) attacks because the plugin’s XML parser is not configured to disable external entities. This allows an attacker who can control XML input processed by the OSF Bui...

ALSA-2022:7950 Low: Image Builder security, bug fix, and enhancement update

Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fixes: golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...

flatpak-builder security and bug fix update

1.0.14-2 - Fix CVE-2022-21682 2042007 1.0.14-1 - Update to 1.0.14 2047312...

Low: Image Builder security, bug fix, and enhancement update

Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fixes: golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...

AlmaLinux 8 : Image Builder (ALSA-2022:7548)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:7548 advisory. - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of...

Semrush: IDOR vulnerability reveals additional information

An issue was identified in the Content Outline Builder product. Changing a user ID in a GraphQL request could reveal additional information about users. A subsequent internal review revealed no evidence of exploitation by unauthorized parties...

WP Page Builder <= 1.2.8 - Admin+ Stored Cross-Site

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. Navigate to Setting » add the payload: ", into...

WordPress WP Page Builder plugin <= 1.2.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Vaibhav Koli in the WordPress WP Page Builder plugin versions = 1.2.8. Solution Deactivate and delete. This plugin has been closed as of 9. November, 2022 and is not available for download. This closure is temporary, pending a full...

WP Page Builder <= 1.2.8 - Admin+ Stored Cross-Site

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC Navigate to Setting » add the payload: ", int...

CentOS 8 : Image Builder (CESA-2022:7548)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:7548 advisory. - golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service CVE-2022-32189...

CentOS 8 : flatpak-builder (CESA-2022:7458)

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2022:7458 advisory. - flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory CVE-2022-21682 Note that Nessus has not tested for this issue b...

RHEL 8 : Image Builder (RHSA-2022:7548)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7548 advisory. Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security...

Moderate: Red Hat Security Advisory: flatpak-builder security and bug fix update

An update for flatpak-builder is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Low: Red Hat Security Advisory: Image Builder security, bug fix, and enhancement update

An update for cockpit-composer, osbuild, osbuild-composer, and weldr-client is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

RLSA-2022:7548 Low: Image Builder security, bug fix, and enhancement update

Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Security Fixes: golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service...

Image Builder security, bug fix, and enhancement update

An update is available for cockpit-composer, weldr-client. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Image Builder is a service for building customized OS...

flatpak-builder security and bug fix update

An update is available for flatpak-builder. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak-builder is a tool for building flatpaks from sources. Securit...

RLSA-2022:7458 Moderate: flatpak-builder security and bug fix update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory CVE-2022-21682 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

Moderate: flatpak-builder security and bug fix update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory CVE-2022-21682 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

RHEL 8 : flatpak-builder (RHSA-2022:7458)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:7458 advisory. Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak: flatpak-builder --mirror-screenshots-url can access files...