Security Bulletin: IBM App Connect Enterprise Certified Container operator and IntegrationServer operands may be vulnerable to loss of confidentiality due to CVE-2022-30629

Summary The IBM App Connect Enterprise Certified Container operator and IntegrationServer operands utilise Golang Go. The IBM App Connect Enterprise Certified Container operator and IntegrationServer operands may be vulnerable to loss of confidentiality. This bulletin provides patch information t...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and IntegrationServer operands may be vulnerable to denial of service due to CVE-2022-23806

Summary The IBM App Connect Enterprise Certified Container operator and IntegrationServer operands utilise Golang Go. The IBM App Connect Enterprise Certified Container operator and IntegrationServer operands may be vulnerable to denial of service. This bulletin provides patch information to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to CVE-2021-44532

Summary Node.js is used by all operands in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions. This bulletin provides patch information to address the reported vulnerability CVE-2021-44532...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to CVE-2021-44531

Summary Node.js is used by all operands in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions. This bulletin provides patch information to address the reported vulnerability CVE-2021-44531...

CVE-2021-25370

creationtimestamp| type| source ---|---|--- 2022-11-04 15:50:00+00:00| seen| https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html 2022-11-05 13:30:01+00:00| exploited| https://t.me/CyberSecurityTechnologies/7108 2022-11-10 13:21:36+00:00|...

Fedora: Security Advisory for python3.11 (FEDORA-2022-a04a020e48)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

kernel security, bug fix, and enhancement update

5.14.0-70.30.1.0.10.OL9 - lockdown: also lock down previous kgdb use Daniel Thompson Orabug: 34290418 CVE-2022-21499 5.14.0-70.30.10.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1629

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1927

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution due to CVE-2022-1785

Summary Vim is not used directly by IBM App Connect Enterprise Certified Container but is present in the operand images as part of the base operating system. Use of vim within IBM App Connect Enterprise Certified Container operands may be vulnerable to arbitrary code execution. This bulletin...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the postgresql connector code may be vulnerable to SQL Injection due to [CVE-2022-35942]

Summary The postgresql Loopback connector is available in the IntegrationServer image from IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container does not use this component directly but it is available for use by an application developed to run in an...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Box connector may be vulnerable to arbitrary code execution due to [CVE-2022-36067]

Summary Node.js module vm2 is used by the Box connector in IBM App Connect Enterprise Certified Container IntegrationServer operands. IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Box connector may be vulnerable to arbitrary code injection. This bulletin...

Deprecated ChainLink API

Lines of code Vulnerability details Impact According to Chainlink's documentation, the latestAnswer function is deprecated. This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data. Proof of Concept function latestAnswer externa...

Important: Red Hat Security Advisory: Satellite 6.11.4 Async Security Update

Updated Satellite 6.11 packages that fix several bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other clie...

Upgraded Q -> M from 437 [1666362126304]

Judge has assessed an item in Issue 437 as Medium risk. The relevant finding follows: Use safetransferfrom instead of transferfrom for ERC721. According to OpenZeppelin's documentation, transferFrom is discouraged and use safeTransferFrom instead. --- The text was updated successfully, but these...

CVE-2022-1970

Rejected reason: The originally reported issue in https://github.com/syedsohaibkarim/OpenRedirect-Keycloak18.0.0 is a known misconfiguration, and recommendation already exists in the Keycloak documentation to mitigate the issue:...

Security Bulletin: Operations Dashboard is vulnerable to Golang Go vulnerabilities (CVE-2022-27664 and CVE-2022-32190)

Summary Operations Dashboard is vulnerable to Go vulnerabilities listed below. Vulnerability Details CVEID:CVE-2022-27664 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in net/http. By sending a specially-crafted request, a remote attacker could exploit this...

Exploit for Improper Initialization in Linux Linux_Kernel

!Dirty Pipehttps://forum.hackersploit.org/uploads/default/ori...

GHSA-JJMG-X456-W976 Incorrect default cookie name and recommendation

Impact What kind of vulnerability is it? Who is impacted? The default cookie name and documentation recommendation was prefixed with Host instead of Host-. The point of this prefix is for additional security, to ensure that, when no domain option is provided in the cookie options, we can guarante...

MGASA-2022-0359 Updated python3 packages fix security vulnerability

Converting between int and str in bases other than 2 binary, 4, 8 octal, 16 hexadecimal, or 32 such as base 10 decimal now raises a ValueError if the number of digits in string form is above a limit to avoid potential denial of service attacks due to the algorithmic complexity. CVE-2020-10735...