CVE-2022-35503

Open Source MANO versions v7 through v12 are vulnerable to arbitrary code execution due to improper verification of user input. An authenticated attacker can exploit this by using a Virtual Network Function (VNF) descriptor to execute code within the LCM module container . Successful exploitation...

Spring UriComponentsBuilder SSRF

The vulnerability of the UriComponentsBuilder component in the Spring Framework’s URL analysis module exists due to insufficient validation of data entered by users. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

Malicious code in ui-common-components-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0d823ab954cd19f85bb933d25f8230386023a6a1fd15430efce0298f6a25aa9 The OpenSSF Package Analysis project identified 'ui-common-components-angular' @ 1.3.1 npm as malicious. It is considered malicious because: - T...

Vulnerabilities fixed in Oracle Enterprise Manager

Oracle has fixed vulnerabilities in Enterprise Manager components. A malicious party could exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Data manipulation. Remote code execution...

@cardinal/namespaces-components (>=4.1.0, <=5.0.0), @frakters/fusion-pool (>=1.0.0, <=1.0.4) +1 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.32.0)

@solana/web3.js NPM version 1.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @cardinal/namespaces-components =4.1.0, =1.0.0, =0.0.29, =0.0.32 Source cves: CVE-2024-30253 Source advisory: MEND:CVE-2024-30253...

Oracle Patch Update, April 2024 Security Update Review

Oracle released its second quarterly edition of Critical Patch Update, which contains patches for 441 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-par...

UBUNTU-CVE-2024-22262

Applications that use UriComponentsBuilder to parse an externally provided URL e.g. through a query parameter AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-3573 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-3573 Source advisory: OSV:GHSA-HQ88-WG7Q-GP4G...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1594 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1594 Source advisory: OSV:GHSA-M49C-5C52-6696...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1593 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1593 Source advisory: OSV:GHSA-F42M-MVFV-CGW5...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1558 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1560 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1560 Source advisory: OSV:GHSA-5MVJ-WMGJ-7Q8C...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-1483 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-1483 Source advisory: OSV:GHSA-F82R-JJ5R-6G97...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-3573 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-3573 Source advisory: OSV:PYSEC-2024-243...

Failed to upgrade host components. Error 1920.Service Veeam WAN Accelerator Service failed to start.

Challenge The Veeam WAN Accelerator component upgrade fails with the following error: Failed to upgrade host components. Error: ''Error 1920.Service Veeam WAN Accelerator Service VeeamWANSvc failed to start. Verify that you have sufficient privileges to start system services.' The Components Upda...

Oracle Critical Patch Update Advisory - April 2024

A Critical Patch Update is a collection of patches for multiple security vulnerabilities. These patches address vulnerabilities in Oracle code and in third party components included in Oracle products. These patches are usually cumulative, but each advisory describes only the security patches add...

Security Bulletin: IBM Security QRadar Analyst Workflow app for IBM QRadar SIEM includes components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that might be identified and exploited with automated tools. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-44270 DESCRIPTION: PostCSS could allow a remote attacker to bypass security...

AMCS Group Trux Waste Management Software security vulnerabilities

AMCS Group Trux Waste Management Software is a waste management software application from the AMCS Group organization. A security vulnerability exists in AMCS Group Trux Waste Management Software versions prior to 7.19.0018.26912, which originated from a vulnerability that allows a local attacker...

QEMU Resource Management Error Vulnerability (CNVD-2024-20282)

QEMU Quick Emulator is a set of simulation processor software. The software is fast and cross-platform. A resource management error vulnerability exists in QEMU virtio, which stems from a double-release vulnerability in virtio-gpu, virtio-serial-bus, and virtio-crypto, with an insufficient...

PT-2024-2941

Name of the Vulnerable Software and Affected Versions Spring Framework versions prior to 5.3.34 Spring Framework versions prior to 6.0.19 Spring Framework versions prior to 6.1.6 Description The issue exists due to insufficient validation of user-input data in the UriComponentsBuilder component o...