samba security, bug fix, and enhancement update

4.15.5-5 - resolves: rhbz2064325 - Fix 'create krb5 conf = yes' when a KDC has a single IP address. 4.15.5-4 - resolves: rhbz2057503 - Fix winbind kerberos ticket refresh 4.15.5-3 - related: rhbz1979959 - Fix typo in testparm output 4.15.5-2 - resolves: rhbz1979959 - Improve idmap autorid sanity...

Path Traversal in OWASP Dependency-Check

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

GHSA-HCWX-7Q5V-VC67 Path Traversal in OWASP Dependency-Check

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

GHSA-FQ9F-9WV9-RFMG Improper Certificate Validation in Jenkins

Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as a transitive dependency in Jenkins...

GHSA-VHH3-MVC4-HHQ6 Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks

Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data...

Jenkins Dependency Graph Viewer plugin vulnerable to missing permission checks

Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data...

Security Bulletin: A vulnerability in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager (CVE-2022-22950, CVE-2021-22096, CVE-2022-22968, CVE-2021-22060).

Summary Vulnerabilities in Spring Framework affects IBM Tivoli Application Dependency Discovery Manager CVE-2022-22950, CVE-2021-22096, CVE-2022-22968, CVE-2021-22060. Vulnerability Details CVEID:CVE-2022-22950 DESCRIPTION: VMware Tanzu Spring Framework is vulnerable to a denial of service, cause...

Kubeclarity - Tool For Detection And Management Of Software Bill Of Materials (SBOM) And Vulnerabilities Of Container Images And Filesystems

KubeClarity is a tool for detection and management of Software Bill Of Materials SBOM and vulnerabilities of container images and filesystems. It scans both runtime K8s clusters and CI/CD pipelines for enhanced software supply chain security. SBOM & vulnerability detection challenges Effective...

Malicious NPM Packages Target German Companies in Supply Chain Attack

Cybersecurity researchers have discovered a number of malicious packages in the NPM registry specifically targeting a number of prominent media, logistics, and industrial firms based in Germany to carry out supply chain attacks. "Compared with most malware found in the NPM repository, this payloa...

openSUSE 15 Security Update : php-composer (openSUSE-SU-2022:0132-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0132-1 advisory. - Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install...

RUSTSEC-2022-0042 malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

[SECURITY] Fedora 36 Update: composer-2.3.5-1.fc36

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

RCE due to a dependency confusion

Description Hi team, I hope you are well. I found a dependency confusion vulnerability in this repo. When I analyzed your repo, I found a Makefile which install a dependency : https://github.com/bits-and-blooms/bloom/blob/25ba46ef8744ddeba999dcd048dbb8b0fa87edb3/MakefileL188 go get...

RCE due to a dependency confusion

Description Hi team, I hope you are well. I found a dependency confusion vulnerability in this repo. When I analyzed your repo, I found a Makefile which install a dependency : https://github.com/openziti/ziti/blob/271614d50df5535cf99ad0882649ae0ef7bb88a2/ziti/MakefileL155 go get...

Usage of deprecated transfer to send ETH

Lines of code Vulnerability details Vulnerability details The usage of address.send is considered a bad practice as it only uses 2300 gas and you create a high dependency of gas. It is true that this is only used in an emergency to transfer the funds to the vault, but it always a better practice ...

roaring-landmask (0.4.0) potentially affected by CVE-2022-1343 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-1343 Source advisory: OSV:GHSA-MFM6-R9G2-Q4R7...

roaring-landmask (0.4.0) potentially affected by CVE-2022-1434 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-1434 Source advisory: OSV:GHSA-638M-M8MH-7GW2...

roaring-landmask (0.4.0) potentially affected by CVE-2022-1473 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-1473 Source advisory: OSV:GHSA-G323-FR93-4J3C...

roaring-landmask (0.4.0) potentially affected by CVE-2022-1343 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-1343 Source advisory: OSV:RUSTSEC-2022-0027...

roaring-landmask (0.4.0) potentially affected by CVE-2022-1434 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-1434 Source advisory: OSV:RUSTSEC-2022-0026...