openssl-ibmca bug fix and enhancement update

An update is available for openssl-ibmca. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The openssl-ibmca package provides a dynamic OpenSSL engine for the IBM...

RLSA-2023:1569 Moderate: gnutls security and bug fix update

The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: gnutls: timing side-channel in the TLS RSA key exchange code CVE-2023-0361 For more details about the security issues,...

Rocky Linux 8 : nodejs:16 (RLSA-2023:1582)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:1582 advisory. - The glob-parent package before 6.0.1 for Node.js allows ReDoS regular expression denial of service attacks against the enclosure regular expression...

SUSE SLES15 Security Update : python-cryptography (SUSE-SU-2023:1763-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:1763-1 advisory. - CVE-2023-23931: Fixed memory corruption in Cipher.updateinto bsc1208036. Tenable has extracted the preceding description block directly from the SUSE...

Fedora 38 : nodejs16 / nodejs18 / nodejs20 (2023-973319d5b7)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-973319d5b7 advisory. Fixes for virtual Provides/Requires of nodejs and nodejs-devel ---- Assorted fixes for v8-devel ---- Update to 19.8.1 Fix confilct with nodejs18 ---...

Oracle Linux 8 : nodejs:16 (ELSA-2023-1582)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-1582 advisory. - Rebase to 16.19.1 Resolves: rhbz2153713 Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920 Resolves: CVE-2022-25881...

Security Bulletin: IBM QRadar Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-22313 DESCRIPTION: IBM QRadar Dat...

ALSA-2023:1569 Moderate: gnutls security and bug fix update

The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: gnutls: timing side-channel in the TLS RSA key exchange code CVE-2023-0361 For more details about the security issues,...

Moby 安全漏洞

Moby is an open source project that aims to drive containerization of software and help the ecosystem mainstream container technology. A security vulnerability exists in Moby version 1.12 and later. An attacker exploited the vulnerability to inject arbitrary Ethernet frames into a cryptographic...

Moderate: gnutls security and bug fix update

The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fixes: gnutls: timing side-channel in the TLS RSA key exchange code CVE-2023-0361 For more details about the security issues,...

Risk Fact #4: Misconfigurations Still Prevalent in Web Applications

Qualys Blog Series – Threat Research Unit Report The Open Web Application Security Project OWASP Top 10 is a list of the most common and most critical vulnerabilities that can impact a web application. Security experts rely on the OWASP Top 10 when talking about web app security. The list helps...

Cisco Adaptive Security Appliance Software Low Entropy Keys (cisco-sa-asa5500x-entropy-6v9bHVYP)

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG in Cisco Adaptive Security Appliance ASA Software for Cisco ASA 5506-X, ASA-5508-X and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic...

Cisco Firepower Threat Defense Software Low Entropy Keys (cisco-sa-asa5500x-entropy-6v9bHVYP)

A vulnerability in the deterministic random bit generator DRBG, also known as pseudorandom number generator PRNG in Cisco Firepower Threat Defense FTD Software for Cisco ASA 5506-X, ASA-5508-X and ASA 5516-X Firewalls could allow an unauthenticated, remote attacker to cause a cryptographic...

Akuvox E11

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Akuvox Equipment: E11 Vulnerabilities: Generation of Predictable IV with CBC, User of Hard-coded Cryptographic Key, Missing Authentication for Critical Function, Storing Passwords in a Recoverable...

Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family (CVE-2011-3389)

Summary Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family CVE-2011-3389 Vulnerability Details Security Bulletin --- Summary --- SSL and TLS vulnerabilities were disclosed in September 2011. This vulnerability has been referred to as the...

Security Bulletin: IBM FlashSystem 9100 family and IBM Storwize V7000 2076-724 (Gen3) systems are NOT affected by security vulnerabilities CVE-2018-12037 and CVE-2018-12038

Summary IBM FlashSystem 9100 systems and Storwize V7000 2076-724 Gen3 systems are NOT affected by the security vulnerabilities where, by the absence of a cryptographic link between the password and the Disk Encryption Key, allows attackers with privileged access to SSD firmware to gain full acces...

Wago Multiple Products Missing Authentication for Critical Function (CVE-2022-3738)

The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like credentials and cryptographic material. A valid user has to create a backup after the last reboot for this attack to be successfull. This...

The vulnerability of the RPM package manager’s reading function allows a perpetrator to compromise data integrity.

The vulnerability of the RPM package manager’s reading function is related to improper verification of the cryptographic signature of data. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the data...

The vulnerability of the Perl programming language’s Module::Signature::_verify() function allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Perl programming language’s Module::Signature::verify function is related to improper verification of the cryptographic signature of data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service...

The vulnerability of the SGIUtility component in the HMI terminal configuration software for Schneider Electric EcoStruxure Operator Terminal Expert and the SCADA Pro-face BLUE software allows a malicious individual to execute arbitrary code.

The vulnerability of the SGIUtility component in Schneider Electric’s HMI terminal configuration software, as well as in the SCADA Pro-face BLUE software, is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to execute arbitrary...