ae.teletronics.nlp:entityextraction (=1.3), ae.teletronics.nlp:w2vec (=1.0) +15912 more potentially affected by CVE-2019-10202 via org.codehaus.jackson:jackson-mapper-asl (>=0.9.8 <=1.9.13)

org.codehaus.jackson:jackson-mapper-asl MAVEN version =0.9.8, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.10 and more Source cves: CVE-2019-10202 Source advisory: OSV:GHSA-C27H-MCMW-48HV...

GHSA-9X5V-8352-244G Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries...

Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries...

Golang/x/crypto message forgery vulnerability

A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The...

GHSA-R5C5-PR8J-PFP7 golang.org/x/crypto/salsa20/salsa uses insufficiently random values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the...

com.ethlo.lamebda:lamebda-core (>=0.4.0 <=0.5.3), com.ethlo.lamebda:lamebda-server (>=0.5.1 <=0.5.3) +33 more potentially affected by CVE-2019-11405 via org.openapitools:openapi-generator (>=3.0.0 <=4.0.0-beta3)

org.openapitools:openapi-generator MAVEN version =3.0.0, =0.4.0, =0.5.1, =0.4.0, =0.4.0, =0.4.0, =1.1.0, =1.2.0, =0.0.6, =1.1.0, =0.0.5, =1.4.0, =1.1.0, =1.1.0, =1.1.0, =1.3.0 and more Source cves: CVE-2019-11405 Source advisory: OSV:GHSA-27J5-2H6R-C9Q2...

Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the...

CVE-2022-31467

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature...

[SECURITY] Fedora 35 Update: dotnet6.0-6.0.105-1.fc35

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

[SECURITY] Fedora 34 Update: dotnet6.0-6.0.105-1.fc34

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2 <=4.6.0.0), ai.ylyue:yue-library-auth-client (=j11.2.6.0) +1509 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=5.6.0 <=5.6.3)

org.springframework.security:spring-security-web MAVEN version =5.6.0, =4.4.0.2, =0.2.0, =2.1.0.M8, =1.0.0, =2.7.0.Beta4, =2.7.0.Beta4, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.Beta1, =2.7.0.Beta1, =2.7.0.Beta2 and more Source cves: CVE-2022-22978 Source advisory:...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0 <=4.4.0.1), ai.foremast.metrics:foremast-spring-boot-15x-starter (>=0.1.8 <=0.1.11) +5598 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (>=3.0.0.RELEASE <=5.4.10)

org.springframework.security:spring-security-web MAVEN version =3.0.0.RELEASE, =4.4.0.0, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3, =1.1.0.RELEASE, =0.3, =0.3, =0.3, =0.3, =0.6 and more Source cves: CVE-2022-22978 Source advisory: OSV:GHSA-HH32-7344-CG2F...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2 <=4.6.0.0), ai.ylyue:yue-library-auth-client (=j11.2.6.0) +1751 more potentially affected by CVE-2022-22976 via org.springframework.security:spring-security-core (>=5.6.0 <=5.6.3)

org.springframework.security:spring-security-core MAVEN version =5.6.0, =4.4.0.2, =1.3.1.RELEASE, =0.2.0, =0.8.3, =2.1.0.M8, =1.0.0, =2.7.0.Beta3, =2.7.0.Beta4, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.Beta3, =2.7.0.RC1 and more Source cves: CVE-2022-22976 Source advisory: OSV:GHSA-WX54-3278-M5G4...

RHEL 8 : OpenShift Container Platform 4.9.33 (RHSA-2022:2205)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:2205 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Libraries: Untrusted users can modify some Pipeline libraries in Pipeline Shared Groovy Libraries Plugin

A flaw was found in the Jenkins Pipeline: Shared Groovy Libraries plugin. The Jenkins Pipeline: Shared Groovy Libraries plugin allows attackers to submit pull requests. However, the attacker cannot commit directly to the configured Source Control Management SCM to effectively change the Pipeline...

OpenJDK: Missing check for negative ObjectIdentifier (Libraries, 8275151)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Difficult to exploit...

OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler (Libraries, 8277672)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable...

net-snmp bug fix and enhancement update

An update is available for net-snmp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The net-snmp packages provide various libraries and tools for the Simple...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6 <=1.6.12), ai.grakn:janus-factory (>=0.17.0 <=0.18.0) +4475 more potentially affected by CVE-2011-1498 via org.apache.httpcomponents:httpclient (>=4.0.1 <=4.1-beta1)

org.apache.httpcomponents:httpclient MAVEN version =4.0.1, =1.4.6, =0.17.0, =0.2.3.5, =0.2.3.5, =3.14.0.1, =3.8.2.4, =0.2.3.5, =3.14.0.7, =3.16.0.1, =3.14.0.1, =3.10.5.1, =3.10.4.1, =3.10.4.1, =3.20.0.1, =3.32.1.5 and more Source cves: CVE-2011-1498 Source advisory: OSV:GHSA-GW85-4GMF-M7RH...

be.objectify:objectify-struts2-tags (=1.0), br.net.woodstock.rockframework:rockframework-web (>=1.2.1 <=1.2.2) +76 more potentially affected by CVE-2011-1772 via org.apache.struts:struts2-core (>=2.0.5 <=2.2.1.1)

org.apache.struts:struts2-core MAVEN version =2.0.5, =1.2.1, =0.6, =3.0, =2.4.0, =2.1.0, =3.0.2 and more Source cves: CVE-2011-1772 Source advisory: OSV:GHSA-56F8-G68R-J699...