GitLab 11.2 < 16.2.8 / 16.3 < 16.3.5 / 16.4 < 16.4.1 (CVE-2023-3920)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands may be vulnerable to loss of confidentiality

Summary The Bouncy Castle Crypto Package For Java is used by the MQ Client in IBM App Connect Enterprise Certified Container IntegrationServers and IntegrationRuntimes. This bulletin provides patch information to address the reported vulnerability in the Bouncy Castle Crypto Package For Java...

PT-2023-26833 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 11.2 through 16.2.8 GitLab versions 16.3 through 16.3.5 GitLab versions 16.4 through 16.4.1 Description: An issue has been discovered in GitLab where a maintainer could create a fork relationship between existing projects...

Amazon Linux 2 : tomcat (ALASTOMCAT8.5-2023-005)

The version of tomcat installed on the remote host is prior to 8.5.79-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2TOMCAT8.5-2023-005 advisory. A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux,...

biz.gabrys.maven:plugin-utils (>=1.0, <=1.4.1), net.sf.buildbox:buildbox-util (1.0.0) +5 more potentially affected by CVE-2022-4244 via org.codehaus.plexus:plexus-utils (2.0.0)

org.codehaus.plexus:plexus-utils MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - biz.gabrys.maven:plugin-utils =1.0, =1.6.0, =1.6.0, =1.6.1, =1.8.4 -...

biz.gabrys.maven:plugin-utils (>=1.0, <=1.4.1), net.sf.buildbox:buildbox-util (1.0.0) +5 more potentially affected by CVE-2022-4245 via org.codehaus.plexus:plexus-utils (2.0.0)

org.codehaus.plexus:plexus-utils MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.codehaus.plexus:plexus-utils and may be impacted: - biz.gabrys.maven:plugin-utils =1.0, =1.6.0, =1.6.0, =1.6.1, =1.8.4 -...

musikfest-goslar.de Cross Site Scripting vulnerability OBB-3707234

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

2023 OWASP Top-10 Series: API9:2023 Improper Inventory Management

Welcome to the 10th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API9:2023 Improper Inventory Management. In this series we are taking an in-depth look at each category – the details, the impac...

Arbitrary Code Execution

Apache airflow hdfs provider package is found to be vulnerable to code execution. Incorrect documentation points users to install an incorrect pip package. Since this package is unverified, an attacker can claim this package and provide code that would be executed when this package was installed...

Paketo Buildpacks Bionic End Of Support

The Spring Boot plugins for Maven and Gradle provide the ability to build Docker images using Cloud Native Buildpacks. By default, Spring Boot uses the CNB builders provided by the Paketo Buildpacks project. What's Changed The Paketo Buildpacks project has announced that Ubuntu 18.04 Bionic-based...

CVE-2023-43635 Vault Key Sealed With SHA1 PCRs

Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry. These PCRs are then used in order to seal/unseal a key from the...

Exploit for PHP External Variable Modification in Juniper Junos

Vulnerability Scanner for Juniper CVE-2023-36845 This vulnera...

[SECURITY] Fedora 37 Update: flac-1.3.4-3.fc37

FLAC stands for Free Lossless Audio Codec. Grossly oversimplified, FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of the stream format, reference encoders and decoders in library form, flac, a command-line program to encode and decode FLAC files, metaflac, a command-line...

Fedora: Security Advisory for python3-docs (FEDORA-2023-aeb32a843f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: python3-docs-3.11.5-1.fc37

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to HTTP header injection due to Go CVE-2023-29406

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to HTTP header injection due to Go CVE-2023-29406 with details below. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-29406 DESCRIPTION: Golang Go is vulnerable to HTTP head...

org.eclipse.jetty.documentation:jetty-documentation (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee10.demos:jetty-ee10-demo-embedded (>=12.0.0.alpha0, <=12.0.0.beta1) +4 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee10:jetty-ee10-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee10:jetty-ee10-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: OSV:GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.documentation:jetty-documentation (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee10.demos:jetty-ee10-demo-embedded (>=12.0.0.alpha0, <=12.0.0.beta1) +4 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee10:jetty-ee10-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee10:jetty-ee10-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: GHSA-3GH6-V5V9-6V9J...

Apache HDFS Provider error message suggested

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The...

CVE-2023-41267

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The...