Security Advisory - The input verification vulnerability of a Huawei Device product is involved.

A Huawei device has an input verification vulnerability. Successful exploitation of this vulnerability may lead to DoS attacks. Vulnerability ID: HWPSIRT-2022-49379 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-37395. For products that have released...

SUSE SLES12 Security Update : python-numpy (SUSE-SU-2022:2645-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2645-1 advisory. - CVE-2021-41495: Fixed Null Pointer Dereference in numpy.sort bsc1193911. Tenable has extracted the preceding description block directly fr...

SUSE: Security Advisory (SUSE-SU-2022:2441-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-21531

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

Code injection

Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystem. The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise Oracle Solaris. Successful attacks of this vulnerability can...

CVE-2022-21527

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

Microsoft Windows Multiple Vulnerabilities (KB5015807)

This host is missing an important security update according to Microsoft KB5015807 SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2022-31129

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...

CVE-2022-31129

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...

Denial Of Service (DoS)

webkit2gtk is vulnerable to denial of service DoS attacks. Windows Common Log File System Driver component allow remote attackers to cause application crashes...

CVE-2022-31129 Inefficient Regular Expression Complexity in moment

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...

CVE-2022-31129

Moment.js (JavaScript date library) contains a vulnerability in string-to-date parsing via RFC2822 parsing, causing quadratic (N^2) complexity and potential (Re)DoS for long inputs (>10k chars). The issue is mitigated by upgrading to Moment.js v2.29.4 or later; if upgrading is not possible, li...

CVE-2022-31129 Inefficient Regular Expression Complexity in moment

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment more specifically rfc2822 parsing, which is tried by default has...

ROS-20220706-02

The Rubygem Rack web application development interface vulnerability is related to incorrect input validation when processing data transmitted through the Rack Lint middleware and CommonLogger middleware. Exploitation of the vulnerability could allow an attacker acting remotely to send specially...

FreeBSD : py-numpy -- Missing return-value validation of the function PyArray_DescrNew (b51cfaea-e919-11ec-9fba-080027240888)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b51cfaea-e919-11ec-9fba-080027240888 advisory. - DISPUTED Null Pointer Dereference vulnerability exists in numpy.sort in NumPy and 1.19 in the...

SUSE SLED15 / SLES15 Security Update : google-gson (SUSE-SU-2022:2044-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2044-1 advisory. - The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the...

GHSA-P498-RPCW-3578 XXE vulnerability Jenkins Warnings Plugin

Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

Debian: Security Advisory (DLA-3001-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3001-1] libgoogle-gson-java security update

Debian LTS Advisory DLA-3001-1 [email protected] https://www.debian.org/lts/security/ Dominik George May 13, 2022 https://wiki.debian.org/LTS Package : libgoogle-gson-java Version : 2.4-1+deb9u1 CVE ID : CVE-2022-25647 Debian Bug : 1010670 It was discovered that the package...

RHEL 8 : kernel (RHSA-2022:1988)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1988 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: fget: check that the fd still...