Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities

Summary IBM Cloud Transformation Advisor has addressed multiple security vulnerabilities including those in Node.js, IBM WebSphere Application Server Liberty and various other libraries. Vulnerability Details CVEID:CVE-2022-3171 DESCRIPTION: protobuf-java core and lite are vulnerable to a denial ...

ch.mobi.mobitor:mobitor-base (>=3.1.305 <=3.1.485), cloud.piranha.extension:piranha-extension-hazelcast (>=21.6.0 <=21.10.0) +147 more potentially affected by CVE-2022-36437 via com.hazelcast:hazelcast (>=4.2 <=4.2.5)

com.hazelcast:hazelcast MAVEN version =4.2, =3.1.305, =21.6.0, =1.37.0, =0.5.0, =3.1.5, =1.1.1, =1.1.1, =1.1.1, =1.1.0, =1.1.1, =1.1.6 and more Source cves: CVE-2022-36437 Source advisory: OSV:GHSA-C5HG-MR8R-F6JP...

[SECURITY] Fedora 36 Update: python3.10-3.10.9-1.fc36

Python 3.10 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

CVE-2022-22736

If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.This bug only affects Firefox for Windows in a non-default installation...

Arbitrary Code Execution

squirrel.windows is vulnerable to arbitrary code execution. The vulnerability exists because the MitigateDllHijacking function of winmain.cpp insecurely loads the dynamic link libraries dll, allowing an attacker to inject and execute malicious code...

JVN#29902403: Installers generated by Squirrel.Windows may insecurely load Dynamic Link Libraries

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact...

libraries.maine.edu Cross Site Scripting vulnerability OBB-3111121

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Department of State: xss and html injection on ( https://labs.history.state.gov)

Possible XSS and HTML injection vulnerabilities were found on the website https://labs.history.state.gov through the "id" parameter, as user input was not sanitized and the website was using a vulnerable version of the jQuery library. Attackers could have exploited these vulnerabilities to execut...

heritage.christchurchcitylibraries.com Cross Site Scripting vulnerability OBB-3108687

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

laZzzy - Shellcode Loader, Developed Using Different Open-Source Libraries, That Demonstrates Different Execution Techniques

laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion Encrypte...

[SECURITY] Fedora 36 Update: python3.11-3.11.1-1.fc36

Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.11 package provides the "python3.11" executable:...

[SECURITY] Fedora 36 Update: python3.12-3.12.0~a3-1.fc36

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...

ai.foxpay.api:foxpay-sdk (>=1.0 <=1.1), ai.genauth:genauth-java-sdk (=3.1.11) +1490 more potentially affected by CVE-2022-4565 via cn.hutool:hutool-core (>=4.0.0 <=5.8.10)

cn.hutool:hutool-core MAVEN version =4.0.0, =1.0, =j8.2.2.0, =j8.2.2.0, =Finchley.SR2.SR1, =Finchley.SR4, =j8.2.2.0, =Finchley.SR2.SR1, =Finchley.SR2.SR1, =Finchley.SR4, =j8.2.2.0, =j8.2.2.0, =1.0.2, =1.0.4.R, =1.0.6.R and more Source cves: CVE-2022-4565 Source advisory: OSV:GHSA-47VX-FQR5-J2GW...

H5P - Create and Share Rich Content and Applications - Moderately critical - Remote Code Execution - SA-CONTRIB-2022-064

This module enables you to create interactive content. The module doesn't sufficiently stop path traversal attacks through zipped filenames for the uploadable .h5p files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "update h5p libraries". In...

ai.tock:tock-nlp-dialogflow (=22.3.1), ai.tock:tock-nlp-model-stanford (=22.3.1) +1290 more potentially affected by CVE-2022-3509 via com.google.protobuf:protobuf-java (>=3.20.0 <=3.20.2)

com.google.protobuf:protobuf-java MAVEN version =3.20.0, =0.10.0, =3.0.0, =0.0.6, =0.0.6, =0.9.5, =2.0.0-alpha.0, =2023.0.0.0-RC1, =2023.0.0.0-RC1, =1.0.3, =1.0.3.AS2.RELEASE and more Source cves: CVE-2022-3509 Source advisory: OSV:GHSA-G5WW-5JH7-63CX...

androidx.health:health-services-client (>=1.0.0-alpha02 <=1.0.0-alpha03), androidx.security:security-crypto (=1.0.0-rc01) +70 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.10.0-rc-1 <=3.15.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.10.0-rc-1, =1.0.0-alpha02, =1.2.2, =1.1, =2.15.3unofficial1, =2.15.3unofficial1, =0.2.35-snapshot, =1.3.0, =21.5.0, =25.1.2 and more Source cves: CVE-2022-3510 Source advisory: OSV:GHSA-4GG5-VX3J-XWC7...

be.zvz:KotlinInside (>=1.14.0 <=1.14.6), com.google.protobuf:protobuf-kotlin-lite (>=3.20.0 <=3.20.2) +8 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.20.0 <=3.20.2)

com.google.protobuf:protobuf-javalite MAVEN version =3.20.0, =1.14.0, =3.20.0, =2.12.0, =2.12.0, =2.3.0, =0.2.4, =0.2.6 - io.github.dimensiondev:maskwalletcore =0.5.0 Source cves: CVE-2022-3510 Source advisory: OSV:GHSA-4GG5-VX3J-XWC7...

ai.djl.spring:djl-spring-boot-starter-tensorflow-auto (>=0.15 <=0.18), ai.djl.tensorflow:tensorflow-api (>=0.15.0 <=0.18.0) +7156 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-java (>=3.17.0 <=3.19.5)

com.google.protobuf:protobuf-java MAVEN version =3.17.0, =0.15, =0.15.0, =0.15.0, =0.15.0, =3.32.1.6, =3.32.1.6-1-2.1, =3.32.1.6-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.0.1, =2.8.4-alpha1, =3.0.1-alpha1 and more Source cves: CVE-2022-3510...

2keys (=0.5.1), 8a-scraper (>=0.0.2 <=0.0.4) +1631 more potentially affected by CVE-2022-23491 via certifi (>=2017.11.5 <=2021.5.30)

certifi PYPI version =2017.11.5, =0.0.2, =0.0.6, =1.0.0, =1.0.2, =0.1.1, =1.0.0, =0.1.0, =0.1.0, =1.0.1, =2.1.3, =1.0.0, =2.1.0, =0.0.3, =0.0.4 and more Source cves: CVE-2022-23491 Source advisory: OSV:PYSEC-2022-42986...

com.abavilla:fpi-bot-api (>=1.2.0 <=1.4.2), com.abavilla:fpi-bot-api-core (>=1.2.0 <=1.3.1) +696 more potentially affected by CVE-2022-4147 via io.quarkus:quarkus-vertx-http (>=2.14.0.CR1 <=2.14.1.Final)

io.quarkus:quarkus-vertx-http MAVEN version =2.14.0.CR1, =1.2.0, =1.2.0, =1.2.0, =1.3.2, =1.5.0, =1.5.0, =1.2.1, =1.2.1, =1.2.1, =1.3.2, =1.2.0, =1.2.0, =1.2.0, =1.3.3, =1.4.1 - com.abavilla:fpi-meta-plugin =1.0.19 and more Source cves: CVE-2022-4147 Source advisory: OSV:GHSA-9895-G6X5-XWCP...