The vulnerability of the fs.openAsBlob() method in the Node.js software platform allows attackers to compromise the integrity of protected information.

The vulnerability of the fs.openAsBlob method in the Node.js programming platform is related to errors in using the --allow-fs-read flag for file system access. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information...

PT-2023-6289 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.5.4 Description: The issue is related to a use-after-free error in the ext4 file system driver of the Linux kernel, specifically in the fs/ext4/extents status.c file, related to the ext4 es insert extent...

Juniper Junos OS Pre-Auth RCE (JSA72300)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA72300 advisory. - A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX and SRX Series allows an unauthenticated, network-based attacker to...

The vulnerability of the `btrfs_get_dev_args_from_path()` function in the `fs/btrfs/volumes.c` file of the Linux kernel’s file system allows a privileged attacker to compromise the confidentiality, integrity, and accessibility of protected information, or cause service failures.

The vulnerability of the btrfsgetdevargsfrompath function in the fs/btrfs/volumes.c file of the btrfs file system in the Linux kernel is related to the use of previously freed memory. Exploiting this vulnerability could allow a person with elevated privileges to compromise the confidentiality,...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:3392-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3392-1 advisory. The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security...

The vulnerability of the SQFS file analyzer of the 7-Zip compressor allows a hacker to execute arbitrary code.

The vulnerability of the SQFS-file analyzer of the 7-Zip compressor is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by causing the user to open malicious links or files...

The vulnerability of the dbFree() function in the fs/jfs/jfs_dmap.c file of the Linux kernel’s JFS file system allows a hacker to cause a service failure.

The vulnerability of the dbFree function in the fs/jfs/jfsdmap.c file of the Linux kernel’s JFS file system is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

GHSA-CR5Q-6Q9F-RQ6Q Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

Kernel: btrfs: double free in btrfs_get_root_ref()

...

Microsoft Windows Multiple Vulnerabilities (KB5009543)

This host is missing an important security update according to Microsoft KB5009543 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

A vulnerability has been discovered in Node.js version 20 specifically within the experimental permission model. This flaw relates to improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions. This vulnerability affects all users using the experimental permission model in Node.js 20. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js.

...

Possible File Disclosure of Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037. Versions Affected: = 5.2.0 Not affected: 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5 Impact ActiveSupport::EncryptedFile writes contents that will b...

Amazon Linux 2 : kernel (ALASKERNEL-5.4-2023-051)

The version of kernel installed on the remote host is prior to 5.4.253-167.359. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2023-051 advisory. A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code ca...

Debian DSA-5480-1 : linux - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5480 advisory. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2022-4269...

Debian DLA-3538-1 : zabbix - LTS security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3538 advisory. - Zabbix before 5.0 represents passwords in the users table with unsalted MD5. CVE-2013-7484 - An issue was discovered in...

Medium: kernel

Issue Overview: A flaw in the Linux Kernel found in the GFS2 file system. On corrupted gfs2 file systems the evict code can try to reference the journal descriptor structure, jdesc, after it has been freed and set to NULL. It can lead to null pointer dereference when gfs2transbegin being called a...

Juniper Networks Junos OS EX Access Control Error Vulnerability

Juniper Networks Junos OS EX is a Juniper Networks network operating system for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. Juniper Networks Junos OS EX is vulnerable to an access control error vulnerability that arises from the...

Fedora 37 : chromium (2023-6c8de2cd15)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-6c8de2cd15 advisory. update to 115.0.5790.170. Fixes several security issues Tenable has extracted the preceding description block directly from the Fedora security...

SUSE SLES12 Security Update : nodejs18 (SUSE-SU-2023:3356-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3356-1 advisory. Update to LTS version 18.17.1 security fixes: - CVE-2023-32002: Fixed permissions policies bypass via Module.load bsc1214150. -...

SUSE CVE-2023-4385

A NULL pointer dereference flaw was found in dbFree in fs/jfs/jfsdmap.c in the journaling file system JFS in the Linux Kernel. This issue may allow a local attacker to crash the system due to a missing sanity check...