[SECURITY] Fedora 36 Update: golang-github-appc-docker2aci-0.17.2-9.fc36

Docker2aci is a small library and CLI binary that converts Docker images to A CI. It takes as input either a file generated by "docker save" or a Docker regist ry URL. It gets all the layers of a Docker image and squashes them into an ACI image. Optionally, it can generate one ACI for each layer,...

[SECURITY] Fedora 36 Update: cadvisor-0.44.1-3.fc36

cAdvisor Container Advisor provides container users an understanding of the resource usage and performance characteristics of their running containers. It is a running daemon that collects, aggregates, processes, and exports information about running containers. Specifically, for each container i...

Security Bulletin: Multiple vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the following fix for IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID:CVE-2019-11251 DESCRIPTION: Kubernetes could allow a remote attacker to ga...

Mailhog 1.0.1 Cross Site Scripting

Exploit Title: Mailhog 1.0.1 - Stored Cross-Site Scripting XSS Google Dork: https://www.shodan.io/search?query=mailhog 3500 Date: 06.18.2022 Exploit Author: Vulnz Vendor Homepage: https://github.com/mailhog/MailHog Software Link: https://github.com/mailhog/MailHog Version: 1.0.1 Tested on:...

Design/Logic Flaw

Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering @mentions in the wire-webapp. If a user receives and views a malicious message, arbitrary code is injected and executed in the context of the victim...

Exploit for Off-by-one Error in Sudo_Project Sudo

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo Baron Samed...

OESA-2022-1726 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby Docker Engine prior to version 20.10.14 where containers...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

POC - Atlassian Confluence OGNL Injection Remote Code Executio...

SUSE: Security Advisory (SUSE-SU-2022:2165-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:2165-1 Security update for containerd

This update for containerd fixes the following issues: containerd: - CVE-2022-31030: Fixed denial of service via invocation of the ExecSync API bsc1200145 docker: - Update to Docker 20.10.17-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/201017 . bsc1200145 runc...

Security Bulletin: IBM Sterling Global Mailbox is vulnerable to remote code execution due to Apache Log4j (CVE-2021-4104)

Summary Apache Log4j is used by IBM Sterling Global Mailbox as part of its logging infrastructure. This fix includes Apache Log4j v2.17.1. Vulnerability Details CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the...

Fedora: Security Advisory for moby-engine (FEDORA-2022-3ecd21576a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 7 : kernel (RHSA-2022:5157)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5157 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: cgroups v1 releaseagent featur...

Fedora: Security Advisory for golang-github-docker-libnetwork (FEDORA-2022-3ecd21576a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for docker-engine (EulerOS-SA-2022-1926)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : docker-engine (EulerOS-SA-2022-1926)

According to the versions of the docker-engine packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In containerd an industry-standard container runtime before version 1.2.14 there is a credential leaking vulnerability. If a container...

Exploit for Expression Language Injection in Vmware Spring_Data_Mongodb

CVE-2022-22980 A local based poc of CVE-2022-22980, for the d...

This Week in Spring - June 21st, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? Its been a hot minute since we last chatted. I was in Germany this time last week. Now, Im back in beautiful San Francisco. Today the weather will climb to a monumental 84 F! Thats very unusual, for any time of t...

Malicious code in eva.io-docker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bce1cda6e20d7f451f3363f7baac88a42f37a598bb77cde0c51200f1fae421c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2887 Malicious code in eva.io-docker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bce1cda6e20d7f451f3363f7baac88a42f37a598bb77cde0c51200f1fae421c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...