Security Bulletin: CVE-2021-2163 may affect IBM® SDK, Java™ Technology Edition

Summary CVE-2021-2163 was disclosed as part of the Oracle April 2021 Critical Patch Update. Vulnerability Details CVEID:CVE-2021-2163 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact,...

The vulnerability of the mlx5 driver for libraries and drivers for fast packet processing in DPDK allows the attacker to trigger a service failure.

The vulnerability of the mlx5 driver for libraries and drivers used in fast packet processing in DPDK is related to unlimited resource allocation. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Path traversal

Dell Container Storage Modules 1.2 contains a path traversal vulnerability in goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this vulnerability leading to unintentional access to path outside of restricted directory...

Moodle 跨站请求伪造漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A cross-site request forgery vulnerability exists in Moodle H5P libraries versions 4.0 through 4.0.2 and 3.11 through 3.11.8, which...

Installer of Ricoh Device Software Manager may insecurely load Dynamic Link Libraries

Overview Installer of Device Software Manager provided by RICOH COMPANY, LTD. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Tomohisa Hasegawa of Canon IT Solutions Inc. reported this vulnerability to IPA. JPCERT/CC coordinated wit...

Ricoh Device Software Manager 代码问题漏洞

Ricoh Device Software Manager is a device software manager from Ricoh Japan. A security vulnerability exists in Ricoh Device Software Manager, which arises from the possibility that the installer may load unsafe dynamic link libraries...

[SECURITY] Fedora 35 Update: dotnet3.1-3.1.422-1.fc35

.NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of...

The repository uses versions of OpenZeppelin libraries with critical severity vulnerabilities

Lines of code Vulnerability details Proof of Concept The project uses 4.1.0 for both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable but OpenZeppelin has flagged them as versions with critical severity vulnerability: GHSA-5vp3-v4hc-gx76 Also in those versions you have this...

[SECURITY] Fedora 36 Update: dotnet3.1-3.1.422-1.fc36

.NET Core is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET Core contains a runtime conforming to .NET Standards a set of...

Ubuntu: Security Advisory (USN-3625-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: java-1_8_0-ibm / java-1_8_0-ibm-alsa / java-1_8_0-ibm-devel / etc (SUSE-SU-2022:2899-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2899-1 advisory. - Update to Java 8.0 Service Refresh 7 Fix Pack 11 bsc1202427: - CVE-2022-34169: Fixed an integer truncation issue in the Xalan Jav...

SUSE SLES12: java-1_7_1-ibm / java-1_7_1-ibm-alsa / java-1_7_1-ibm-devel / etc (SUSE-SU-2022:2898-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2898-1 advisory. - Updated to Java 7.1 Service Refresh 5 Fix Pack 15 bsc1202427: - CVE-2022-34169: Fixed an integer truncation issue in the Xalan Ja...

[SECURITY] Fedora 36 Update: dotnet6.0-6.0.108-1.fc36

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Security Bulletin: IBM MQ and IBM WebSphere MQ are affected by Side channel attacks on modular exponentiation (CVE-2016-0702)

Summary IBM MQ and WebSphere MQ have addressed CVE-2016-0702 The GSKit cryptographic libraries supplied with MQ are impacted by the same issue described in the OpenSSL disclosure. Vulnerability Details CVEID: CVE-2016-0702 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive...

Security Bulletin: Multiple vulnerabilities in the IBM SDK for Java™ Technology Edition January 2015 CPU affect WebSphere Business Services Fabric

Summary There are multiple vulnerabilities in IBM® SDK for Java™ Technology Edition that is used by WebSphere Business Services Fabric. These issues were disclosed as part of the IBM SDK for Java™ Technology Edition updates in January 2015. Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION:...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Storage Productivity Center October 2014 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM Tivoli Storage Productivity Center. This also includes a fix for the Padding Oracle On Downgraded Legacy Encryption POODLE SSLv3 vulnerability CVE-2014-3566. These issues were disclosed as par...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Tivoli Storage Productivity Center July 2014 CPU

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with Tivoli Storage Productivity Center. These issues were disclosed as part of the IBM Java SDK updates in July 2014. Vulnerability Details The following advisories are included in the IBM® SDK Java™...

CVE-2022-30945

A flaw was found in Jenkins Groovy Plugin. The plugin allows pipelines to load Groovy source files. The intent is to allow Global Shared Libraries to execute without sandbox protection. The issue is that the plugin allows any Groovy source files bundled with Jenkins core and plugins to be loaded...

PT-2022-4345 · Aveva · Aveva Edge

Name of the Vulnerable Software and Affected Versions: AVEVA Edge 2020 SP2 Patch 04201.2111.1802.0000 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious...

PT-2022-4347 · Aveva · Aveva Edge

Name of the Vulnerable Software and Affected Versions: AVEVA Edge versions 2020 SP2 Patch 04201.2111.1802.0000 Description: The issue is related to the improper restriction of XML External Entity XXE references in the LoadImportedLibraries method, allowing remote attackers to disclose sensitive...