8444 matches found
Spring Core Remote Code Execution via Data Binding on JDK 9+
A remote code execution RCE vulnerability was discovered in the Spring framework, affecting at least Spring versions 4.x and 5.x. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the...
Spring Cloud Azure 4.0 is Now Generally Available
NOTE: Hi, Spring fans! This is a guest post from Sean Li, our friend at Microsoft I am pleased to announce that Spring Cloud Azure 4.0 is now generally available. With this major release we aim to bring better security, leaner dependencies, support for production readiness and more. Version 4...
A Large-Scale Supply Chain Attack Distributed Over 800 Malicious NPM Packages
A threat actor dubbed "RED-LILI" has been linked to an ongoing large-scale supply chain attack campaign targeting the NPM package repository by publishing nearly 800 malicious modules. "Customarily, attackers use an anonymous disposable NPM account from which they launch their attacks," Israeli...
maven: Block repositories using http by default
A flaw was found in maven. Repositories that are defined in a dependency’s Project Object Model pom, which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that...
[SECURITY] Fedora 34 Update: cabal-rpm-2.0.11-1.fc34
This package provides a RPM packaging tool for Haskell Cabal-based packages. cabal-rpm has commands to generate a RPM spec file and srpm for a package. It can rpmbuild packages, yum/dnf install their dependencies, prep packages, and install them. There are commands to list package dependencies an...
[SECURITY] Fedora 35 Update: cabal-rpm-2.0.11-1.fc35
This package provides a RPM packaging tool for Haskell Cabal-based packages. cabal-rpm has commands to generate a RPM spec file and srpm for a package. It can rpmbuild packages, yum/dnf install their dependencies, prep packages, and install them. There are commands to list package dependencies an...
SUSE-SU-2022:0935-1 Security update for nodejs12
This update for nodejs12 fixes the following issues: Update to 12.22.11, which adjusts dependencies for openssl sources to 1.1.1n. Addressing the following issue in openssl: - CVE-2022-0778: Infinite loop in BNmodsqrt reachable when parsing certificates bsc1196877...
0.8.18-p11 (0.8.18-p12), 0.extends.wechat (>=1.0.51, <=1.0.65) +10280 more potentially affected by CVE-2021-44906 via minimist (>=1.0.0, <=1.2.5)
minimist NPM version =1.0.0, =1.0.51, =2.3.0, =0.0.1, =1.0.0, =1.0.0, =0.0.2, =0.3.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.14 and more Source cves: CVE-2021-44906 Source advisory: OSV:GHSA-XVCH-5GV4-984H...
01-numacert (>=1.0.0, <=3.0.0), 06-tekbooks (0.1.0) +46667 more potentially affected by CVE-2021-44906 via minimist (>=0.0.2, <=0.2.1)
minimist NPM version =0.0.2, =1.0.0, =0.3.0, =0.0.15, =1.0.4, =1.0.0, =1.0.0, =1.0.1 - 20190403-utils 1.0.0 - 20231122-npm 1.0.0 and more Source cves: CVE-2021-44906 Source advisory: OSV:GHSA-XVCH-5GV4-984H...
Hidden functionality in node-ipc
The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions 9.2.2...
GHSA-8GR3-2GJW-JJ7G Hidden functionality in node-ipc
The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions 9.2.2...
systemd bug fix and enhancement update
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes...
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
Impact Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities: Ping flood: https://vulners.com/cve/CVE-2019-9512 Reset flood: https://vulners.com/cve/CVE-2019-9514 Settings flood: https://vulners.com/cve/CVE-2019-9515 A Twisted...
Exploit for Improper Initialization in Linux Linux_Kernel
Dirty Pipe automatic root exploit CVE-2022-0847 !eaeasse...
SUSE-SU-2022:0810-1 Security update for tomcat
This update for tomcat fixes the following issues: - Remove hard log4j dependency, as it is not required by tomcat itself bsc1196137...
Multiple Security Flaws Discovered in Popular Software Package Managers
Multiple security vulnerabilities have been disclosed in popular package managers that, if potentially exploited, could be abused to run arbitrary code and access sensitive information, including source code and access tokens, from compromised machines. It's, however, worth noting that the flaws...
AlmaLinux 8 : ruby:2.6 (ALSA-2022:0543)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:0543 advisory. rubygem-bundler: Dependencies of gems with explicit source may be installed from a different source CVE-2020-36327 rubygem-rdoc: Command injection...
wordpress -- multiple issues
wordpress developers reports: This security and maintenance release features 1 bug fix in addition to 3 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated. The security team would li...
SUSE-SU-2022:0784-1 Security update for tomcat
This update for tomcat fixes the following issues: Security issues fixed: - CVE-2022-23181: Fixed time of check, time of use vulnerability that allowed local privilege escalation. bsc1195255 - Remove log4j dependency, which is currently directly in use bsc1196137 - Make the package RPM conflict...