Updated libssh2 packages fix a security vulnerability (Terrapin Attack)

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

PT-2024-15084 · WordPress · Metform Elementor Contact Form Builder

Name of the Vulnerable Software and Affected Versions: Metform Elementor Contact Form Builder plugin for WordPress versions up to, and including, 3.8.1 Description: The issue is due to missing or incorrect nonce validation on the contents function, making it possible for unauthenticated attackers...

GLSA-202401-03 : BlueZ: Privilege Escalation

The remote host is affected by the vulnerability described in GLSA-202401-03 BlueZ: Privilege Escalation - Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitti...

PVS | Error Id: XDDS:A6D8C1E7 - Unable to add Target Device to Catalog

Attempting to add Target Devices will return the following error: "The virtual machine with Mac Address in the selected Device Collection could not be found in any available connection". In View Details the following information is present: Error Id: XDDS:A6D8C1E7 Exception: DesktopStudioErrorId ...

Ubuntu 22.04 LTS : Node.js vulnerabilities (USN-6564-1)

The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6564-1 advisory. Hubert Kario discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted...

CVE-2023-52277

Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service Heap Memory Corruption and application crash or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing i...

CVE-2023-52277

Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service Heap Memory Corruption and application crash or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing i...

CVE-2023-52277

Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service Heap Memory Corruption and application crash or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing i...

Memory corruption

Royal RoyalTSX before 6.0.2.1 allows attackers to cause a denial of service Heap Memory Corruption and application crash or possibly have unspecified other impact via a long hostname in an RTSZ file, if the victim clicks on Test Connection. This occurs during SecureGatewayHost object processing i...

CVE-2023-52266

ehttp 1.0.6 before 17405b9 has an epollsocket.cpp readfunc use-after-free. An attacker can make many connections over a short time to trigger this...

CVE-2023-52266

CVE-2023-52266 affects ehttp 1.0.6 prior to 17405b9. The root cause is a use-after-free in the epoll_socket.cpp read_func, enabling an attacker to trigger memory corruption by opening many connections in a short time. Documented references consistently describe the issue and indicate a fix is ava...

Infinispan caches credentials in clear text

A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials JDBC store with connection pooling, remote store, the credentials are returned in clear text as part of the configuration...

CVE-2023-47091

An issue was discovered in Stormshield Network Security SNS SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible...

Code injection

An issue was discovered in Stormshield Network Security SNS SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible...

Cross site scripting

An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all...

CVE-2023-47091

An issue was discovered in Stormshield Network Security SNS SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible...

CVE-2023-47091

An issue was discovered in Stormshield Network Security SNS SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible...

SUSE CVE-2023-51589

BlueZ Audio Profile AVRCP parsemediaelement Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability ...

SUSE CVE-2023-51592

BlueZ Audio Profile AVRCP parsemediafolder Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information via Bluetooth on affected installations of BlueZ. User interaction is required to exploit this vulnerability i...

CentOS 7 : firefox (RHSA-2023:4079)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:4079 advisory. - An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS. This vulnerability affects Firefox 115,...