Security Bulletin: IBM Cloud Pak for Multicloud Management Monitoring is vulnerable to directory traversal due to its use of Apache Commons IO (CVE-2021-29425)

Summary Apache Commons IO is used by several components in IBM Cloud Pak for Multicloud Management Monitoring. The product does not allow input that processes files or directories, but the affected software has been updated out of an abundance of caution. Vulnerability Details CVEID: CVE-2021-294...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-firefox-91.11.0esr-i686-1slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more...

Stored Cross-Site Scripting vulnerability in Recipe Instructions allows Admin session hijacking

Description A low privilege user can insert malicious JavaScript code into the Recipe Instructions which will execute in another person's browser that visits the recipe. Proof of Concept Reproduction Steps: 1. As a lower privileged user login to the Mealie web application. 2. Create a recipe and...

How to apply pooled licenses to Citrix ADM

This article contains information on how to apply pooled licenses to Citrix ADM...

CVE-2022-31104 Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtime

Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x8664 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bu...

CVE-2022-31104

Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal for WebAssembly on x8664 contained two distinct bugs in the instruction lowerings implemented in Cranelift. The aarch64 implementation of the simd proposal is not affected. The bu...

Malicious Package

Overview example-data-fetching is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Security update for tor (important)

openSUSE Security Update: Security update for tor Announcement ID: openSUSE-SU-2022:10023-1 Rating: important References: 1200672 Cross-References: CVE-2022-33903 Affected Products: openSUSE Backports SLE-15-SP3 openSUSE Backports SLE-15-SP4 An update that fixes one vulnerability is now available...

MAL-2022-1400 Malicious code in b2b-event-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aed27a1d433185da787b0aed1964e26c1a94bb18dcb99a2be19bbc8b0366c53f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1805 Malicious code in calc_wzpz618zfk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c900eab7f1f1661d898474c06532f14cdce4f4a25795357576cc5b631e3531f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3151 Malicious code in free-fortnite-skins-cs3w2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 903397c89bd4c1d11bdaf2b4d2594ae05785164859dcfdcfcfa605154ac9f562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Intel Processors Denial of Service Vulnerability

Intel Processors Intel processors are American Intel Intel companies that provide interpretation of computer instructions and processing of data in computer software. A denial of service vulnerability exists in Intel Processors that originates from incorrect input authentication. An authenticated...

Security Bulletin: IBM Robotic Process Automation is vulnerable to cross tenant disclosure of user ids (CVE-2022-30607)

Summary IBM Robotic Process Automation is vulnerable to cross tenant disclosure of user ids CVE-2022-30607 Vulnerability Details CVEID: CVE-2022-30607 DESCRIPTION: IBM Robotic Process Automation contains a vulnerability that could allow a user to obtain sensitive information due to information...

UBUNTU-CVE-2022-29244

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...

Security Bulletin: Multiple vulnerabilities have been identified in Apache Log4j shipped with IBM Tivoli Netcool/OMNIbus Common Integration Libraries (CVE-2021-4104, CVE-2021-45046, CVE-2021-44228)

Summary Multiple vulnerabilities have been identified within the Apache Log4j library that is used within IBM Tivoli Netcool/OMNIbus Common Integration Libraries. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote...

CVE-2022-29258 Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.58 bug fix and security update

Red Hat OpenShift Container Platform release 4.6.58 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a...

USN-5410-1: NSS vulnerability | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description Lenny Wang discovered that NSS incorrectly handled certain messages. A remote attacker could possibly use this issue to cause servers compiled with NSS to stop responding, resulting in a denial of service...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.9.35 bug fix and security update

Red Hat OpenShift Container Platform release 4.9.35 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a...

USN-5380-1: Bash vulnerability | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that Bash did not properly drop privileges when the binary had the setuid bit enabled. An attacker could possibly use this issue to escalate privileges. Update...