Security Bulletin: Vulnerability in ZooKeeper affects IBM Process Mining CVE-2023-44981

Summary There is a vulnerability in ZooKeeper that could allow an attacker to bypass security restrictions on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-44981...

CVE-2024-21674

This High severity Remote Code Execution RCE vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution RCE vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker ...

CVE-2024-21672

This High severity Remote Code Execution RCE vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server. Remote Code Execution RCE vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H allows an unauthenticated attacker t...

CVE-2024-21674

This High severity Remote Code Execution RCE vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution RCE vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker ...

Security Bulletin: A vulnerability in NSS may affect IBM Robotic Process Automation for Cloud Pak and result in a remote attacker obtaining sensitive information (CVE-2023-4421).

Summary NSS is used by IBM Robotic Process Automation for Cloud Pak as part of Watson NLP. CVE-2023-4421. Vulnerability Details CVEID:CVE-2023-4421 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox, could allow a remote authenticated attacker to obtain sensitive...

Security Bulletin: Multiple security vulnerabilities affect IBM Robotic Process Automation for Cloud Pak.

Summary XZ is used by IBM Robotic Process Automation for Cloud Pak as part of base container images, Watson NLP and WebSphere Liberty. CVE-2020-22916. File is used by IBM Robotic Process Automation for Cloud Pak as part of the base container images, Watson NLP and WebSphere Liberty. CVE-2022-4855...

Maliciously Crafted Cracked Software Propagates Lumma Stealer via YouTube

Summary: In an attempt to deceive users into downloading the information-stealing virus Lumma, threat actors are exploiting YouTube videos featuring content related to cracked software. These videos typically include content related to the use of cracked software, accompanied by identical...

Security Bulletin: IBM Content Navigator is vulnerable to a Code Inject Exploit due to Daeja ViewOne Virtual (CVE-2023-40684)

Summary Daeja ViewOne Virtual is used by IBM Content Navigator as part of the document viewer. CVE-2023-40684. Vulnerability Details CVEID:CVE-2023-40684 DESCRIPTION: IBM Content Navigator with IBM Daeja ViewOne Virtual is vulnerable to cross-site scripting. This vulnerability allows users to emb...

The vulnerability of the Spreadsheet::ParseExcel library for working with XLS files lies in its inability to eliminate instructions in dynamically executed code, allowing attackers to execute arbitrary code.

The vulnerability of the Spreadsheet::ParseExcel library for working with XLS files is related to the lack of measures taken to eliminate instructions in the dynamically executed code. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2023-6129

A flaw was found in in the POLY1305 MAC message authentication code implementation in OpenSSL, affecting applications running on PowerPC CPU-based platforms that utilize vector instructions, and has the potential to corrupt the internal state of these applications. If an attacker can manipulate t...

Security update for opera (important)

openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2024:0016-1 Rating: important References: Cross-References: CVE-2024-0222 CVE-2024-0223 CVE-2024-0224 CVE-2024-0225 CVSS scores: CVE-2024-0222 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2024-0223 NVD ...

Design/Logic Flaw

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC...

CVE-2023-6129

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC...

Low: perl-HTTP-Daemon

Issue Overview: HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based...

CVE-2023-6129

Issue summary: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker can influence whether the POLY1305 MAC...

OpenSSL -- Vector register corruption on PowerPC

The OpenSSL Team reports: The POLY1305 MAC message authentication code implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions...

Low: tar

Issue Overview: It was discovered that tar incorrectly handled extended attributes in PAX archives. An attacker could supply a specially crafted file and cause tar to crash, resulting in a denial of service. CVE-2023-39804 Affected Packages: tar Issue Correction: Run dnf update tar --releasever...

Security Bulletin: A vulnerability in GNU Binutils may affect IBM Robotic Process Automation for Cloud Pak and result in a denial of service (CVE-2019-9074).

Summary GNU Binutils is used by IBM Robotic Process Automation for Cloud Pak as part of Watson NLP. CVE-2019-9074. Vulnerability Details CVEID:CVE-2019-9074 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by an out-of-bounds read leading to a SEGV in bfdgetl32 in libbfd.c i...

Security Bulletin: A vulnerability in WebSphere Liberty may affect IBM Robotic Process Automation and result in weaker than expected security (CVE-2023-46158).

Summary WebSphere Liberty is used by IBM Robotic Process Automation as part of UMS and Micro Services CVE-2023-46158. Vulnerability Details CVEID:CVE-2023-46158 DESCRIPTION: IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to...

Security update for zabbix (important)

openSUSE Security Update: Security update for zabbix Announcement ID: openSUSE-SU-2023:0419-1 Rating: important References: 1218199 Cross-References: CVE-2023-32727 CVSS scores: CVE-2023-32727 NVD : 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-32727 SUSE: 6.8...