[SECURITY] Fedora 36 Update: golang-github-aws-lambda-1.26.0-4.fc36

Libraries, samples and tools to help Go developers develop AWS Lambda functions...

GO-2022-0187 Incorrect computation for P-256 curves in crypto/elliptic

The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect Rational Functional Tester

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 1.8 and IBM® Runtime Environment Java™ Version 1.8 used by Rational Functional Tester. Rational Functional Tester has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21496 DESCRIPTION: An...

PHP Library Remote Code Execution Vulnerability

Several PHP compatibility libraries contain a potential remote code execution flaw in their jsondecode function based on having copy pasted existing vulnerable code. Affected components include the WassUp Realtime analytics WordPress plugin, AjaXplorer Core, and more. JAHx221 - RCE in copy/pasted...

Oracle Linux 8 : libgcrypt (ELSA-2022-5311)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5311 advisory. 1.8.5-7 - Fix CVE-2021-33560 2018525 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus ha...

catalog.ncwlibraries.org Cross Site Scripting vulnerability OBB-2703024

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Netcool Impact

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Tivoli Netcool Impact. IBM Tivoli Netcool Impact has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21365 DESCRIPTION: An unspecified vulnerability in Java SE related to the...

com.github.fommil:spray-json-shapeless_2.12.0-RC2 (=1.3.0), com.typesafe.akka:akka-http-spray-json-experimental_2.12.0-RC2 (=2.4.11) +1 more potentially affected by CVE-2018-18855 via io.spray:spray-json_2.12.0-RC2 (=1.3.2)

io.spray:spray-json2.12.0-RC2 MAVEN version =1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spray:spray-json2.12.0-RC2 and may be impacted: - com.github.fommil:spray-json-shapeless2.12.0-RC2 =1.3.0 -...

python: CRLF injection via HTTP request method in httplib/http.client

A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat fr...

Security Bulletin: Multiple Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition affects WebSphere eXtreme Scale

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 used by WebSphere eXtreme Scale. Vulnerability Details CVEID:CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to...

Multiple Backdoored Python Libraries Caught Stealing AWS Secrets and Keys

Researchers have discovered a number of malicious Python packages in the official third-party software repository that are engineered to exfiltrate AWS credentials and environment variables to a publicly exposed endpoint. The list of packages includes loglib-modules, pyg-modules, pygrata,...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli Business Service Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM Tivoli Business Service Manager. IBM Tivoli Business Service Manager has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-21365 DESCRIPTION: An unspecified vulnerability in Ja...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2022 - Includes Oracle® January 2022 CPU affects IBM Tivoli Composite Application Manager for Transactions-Robotic Response Time

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 ,version 8, that is used by IBM Tivoli Composite Application Manager for Transactions - Robotic Response Time. These issues were disclosed as part of the IBM Java SDK updates in Jan 2022. Vulnerability...

EulerOS 2.0 SP8 : java-1.8.0-openjdk (EulerOS-SA-2022-1932)

According to the versions of the java-1.8.0-openjdk packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported...

Security Bulletin: June 2022 :Multiple vulnerabilities in IBM Java Runtime affect CICS Transaction Gateway

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 7.0, 7.1 and 8.0 used by CICS Transaction Gateway. CICS Transaction Gateway has addressed seven CVEs that can allow denial of service and three CVEs that can allow no confidentiallty impact. Vulnerability Detail...

Malicious code in finastra-nodejs-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e6a9bcca9d10ce688e00eb4a63926581e73d476c15bb88fff42f9fb30a39f25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zeos-libs/auth-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee22ec16fe8410ba0fa17b116c3f3bc6c12ac2f37d88e9e81e5cc13ac891467 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 36 Update: python3.10-3.10.5-2.fc36

Python 3.10 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

glibc bug fix update

An update is available for glibc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The glibc packages provide the standard C libraries libc, POSIX thread librarie...

ai.starlake:starlake-spark2_2.11 (>=0.2.7 <=0.2.8), ai.starlake:starlake-spark3_2.12 (>=0.2.7 <=0.2.10) +83 more potentially affected by CVE-2021-33036 via org.apache.hadoop:hadoop-yarn-server-common (>=3.3.0 <=3.3.1)

org.apache.hadoop:hadoop-yarn-server-common MAVEN version =3.3.0, =0.2.7, =0.2.7, =0.1.30, =0.1.30, =0.1.28, =0.9.0, =2.8.2, =2.8.2, =304, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.1 and more Source cves: CVE-2021-33036 Source advisory: OSV:GHSA-58JX-F5RF-QGQF...