USN-5761-2 ca-certificates update

USN-5761-1 updated ca-certificates. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Due to security concerns, the TrustCor certificate authority has been marked as distrusted in Mozilla's root store. This update removes the...

Denial Of Service (DOS)

Kernel is vulnerable to out of bound reads. A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via the SVMEXITIOIO exit reason...

ivs.witt-es.de Cross Site Scripting vulnerability OBB-3035029

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

es-ballet.com Cross Site Scripting vulnerability OBB-2998914

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Zutty: Arbitrary Code Execution

Background Zutty is an X terminal emulator rendering through OpenGL ES Compute Shaders. Description Zutty does not correctly handle invalid DECRQSS commands, which can be exploited to run arbitrary commands in the terminal. Impact Untrusted text written to the Zutty terminal can achieve arbitrary...

CVE-2022-40738

An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4DescriptorListWriter::Action in Core/Ap4Descriptor.h, called from AP4EsDescriptor::WriteFields and AP4Expandable::Write...

Malicious code in es-int-pluginr-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63eafc51d590884147e692623639aacbbf9a6827c941c329c8778f74f82592ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2781 Malicious code in es-int-pluginr-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63eafc51d590884147e692623639aacbbf9a6827c941c329c8778f74f82592ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerability of microprogramming software for Siemens STEP 7 programmable logic controllers, systems for manufacturing process control such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT Production Suite, the system diagnostic tool SIMOCODE ES, the software for parameterizing, diagnosing, and documenting the startup status of SIRIUS Soft Starter ES, technological process management systems like SIMATIC PCS neo, the Opcenter RD&L software platform, and the software for analyzing equipment efficiency and key indicators like SIMATIC IT LMS. These vulnerabilities allow attackers to trigger malfunctions during maintenance operations due to insufficient input data verification.

The vulnerabilities of the microprogramming software for Siemens STEP 7 programmable logic controllers, the systems for managing production processes such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT...

The vulnerabilities of the microprogramming software for Siemens STEP 7 programmable logic controllers, the systems for managing production processes such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT Production Suite, the system diagnostic tool SIMOCODE ES, the software for parameterizing, diagnosing, and documenting the startup process of SIRIUS Soft Starter ES, the web-based systems for managing technological processes like SIMATIC PCS neo, the Opcenter RD&L software platform, and the software for analyzing equipment efficiency and key indicators like SIMATIC IT LMS. These vulnerabilities arise from the absence of quotation marks in the wording of elements or search methods, which allows attackers to exploit them to gain elevated privileges to the root level.

The vulnerabilities of the microprogramming software for Siemens STEP 7 programmable logic controllers, the systems for managing production processes such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT...

FreeBSD : wolfssl -- multiple issues (9b9a5f6e-1755-11ed-adef-589cfc01894a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9b9a5f6e-1755-11ed-adef-589cfc01894a advisory. - AMD EPYC Processors contain an information disclosure vulnerability in the Secure Encrypted...

Cesanta MJS 代码问题漏洞

Cesanta MJS is an embedded JavaScript engine for C/C++ from Cesanta Ireland. It is designed for microcontrollers with limited resources. The main design goals are a small footprint and simple C/C++ interoperability. A security vulnerability exists in Cesanta MJS mJS: Restricted JavaScript engine...

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.11. Security Fixes: Mozilla: CSP sandbox header without allow-scripts can be bypassed via retargeted javascript: URI CVE-2022-34468 Mozilla: Use-after-free in nsSHistory CVE-2022-34470...

Malicious code in es-sink (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e906ae6ca5366dd26487075c03bc7392f9c04497097db62d334da8b27e75a4ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2782 Malicious code in es-sink (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e906ae6ca5366dd26487075c03bc7392f9c04497097db62d334da8b27e75a4ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3835 Malicious code in ing-orange-login-sca-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ead5ed601ba0e5ae4f1c0bb3896d3e65abf85e1407cbed94361b44a0e676793 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3819 Malicious code in ing-app-login-sca-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2733895abf197c52df4677d58952c072674d664777a0ff775d6bb7c7b9c59dbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ai.houyi:dorado (>=0.0.1 <=0.0.8), ai.houyi:dorado-core (>=0.0.11 <=0.0.51) +12039 more potentially affected by CVE-2022-25845 via com.alibaba:fastjson (>=1.2.25 <=1.2.80)

com.alibaba:fastjson MAVEN version =1.2.25, =0.0.1, =0.0.11, =0.0.16, =0.0.1, =0.0.14, =0.0.47, =0.0.14, =0.1.1, =2.1.0, =2.1.0, =Finchley.SR2.SR1, =Finchley.SR4, =j8.2.2.0, =Finchley.SR2.SR1, =Finchley.SR2.SR1, =j11.2.6.0 and more Source cves: CVE-2022-25845 Source advisory: OSV:GHSA-PV7H-HX5H-M...

ai.grakn:grakn-dist (>=0.7.0 <=0.16.0), ai.grakn:grakn-test (=0.10.0) +1866 more potentially affected by CVE-2019-7614 via org.elasticsearch:elasticsearch (>=0.6.0 <=6.8.19)

org.elasticsearch:elasticsearch MAVEN version =0.6.0, =0.7.0, =0.6.1, =0.11.0, =0.3.0, =1.0.1, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.1.0, =5.2.1 - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-starter =5.2.0 and more Source cves: CVE-2019-7614 Source advisory: OSV:GHSA-JQM6-M3J3-8GG9...

new packages: mythes-es

An update is available for mythes-es. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpri...