python-lxml security update

An update is available for python-lxml. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list lxml is an XML processing library providing access to libxml2 and libxslt...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to an unspecified vulnerability in Java SE ( CVE-2022-21340)

Summary An unspecified vulnerability in Java SE - CVE-2022-21340 related to the Libraries Component has been identified that affects IBM Watson Assistant for IBM Cloud Pak for Data. Java SE is used by IBM Watson Assistant for IBM Cloud Pak for Data as part of its platform for developement of core...

[SECURITY] Fedora 36 Update: golang-x-debug-0-0.13.20210123gitc934e1b.fc36

This repository holds utilities and libraries for debugging Go programs...

[SECURITY] Fedora 36 Update: golang-x-crypto-0-0.43.20220412git7b82a4e.fc36

Go supplementary cryptography libraries...

Security Bulletin: Vulnerability in Java SE - CVE-2022-21294 may affect IBM Watson Assistant for IBM Cloud Pak for Data

Summary A Potential Vulnerability in Java SE - CVE-2022-21294 related to the Libraries component has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information Vulnerability Details CVEID: CVE-2022-21294 DESCRIPTION: An unspecified...

Debian DSA-5128-1 : openjdk-17 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5128 advisory. Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in information disclosure, incorrect validation of ECDSA signatures or...

Debian DSA-5131-1 : openjdk-11 - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5131 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported versions that are affected are...

workflow-cps-global-lib: OS command execution through crafted SCM contents

A flaw was found in Jenkins. The JenkinsPipeline: Shared Groovy Libraries uses the same checkout directories for distinct SCMs for Pipeline libraries. This flaw allows attackers with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. This...

workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries follows symbolic links to locations outside of the expected Pipeline library when reading files using the libraryResource step. This flaw allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controll...

workflow-cps-global-lib: Pipeline-related plugins follow symbolic links or do not limit path names

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries does not restrict the names of resources passed to the libraryResource step. This flaw allows attackers who can configure Pipelines to read arbitrary files on the Jenkins controller file system...

workflow-cps-global-lib: Sandbox bypass vulnerability

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries plugin uses the names of Pipeline libraries to create cache directories without any sanitization. This flaw allows attackers with item/configure permission to execute arbitrary code in the context of the Jenkins controller JVM,...

workflow-cps-global-lib: Sandbox bypass vulnerability

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries Plugin uses the names of Pipeline libraries to create directories without canonicalization or sanitization. This flaw allows attackers with item/configure permission to execute arbitrary code in the context of the Jenkins...

workflow-cps-global-lib: Sandbox bypass vulnerability

A flaw was found in Jenkins. The Pipeline: Shared Groovy Libraries Plugin uses the same workspace directory for all checkouts of Pipeline libraries with the same name, regardless of the SCM used and the source of the library configuration. This flaw allows attackers with item/configure permission...

com.github.jonathanswenson:bqjdbc (>=2.2.11 <=2.2.12), com.moz.fiji.hive:fiji-hive-lib (>=0.1.0 <=0.1.9) +62 more potentially affected by CVE-2009-4611 via org.mortbay.jetty:jetty (>=7.0.0pre0 <=7.0.0.pre5)

org.mortbay.jetty:jetty MAVEN version =7.0.0pre0, =2.2.11, =0.1.0, =0.1.18, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.18, =0.1.18, =0.1.18, =0.1.18, =0.1.18, =3.0.0, =3.0.1 and more Source cves: CVE-2009-4611 Source advisory: OSV:GHSA-6JXP-7G74-2RC3...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +4314 more potentially affected by CVE-2009-1190 via org.springframework:spring-core (>=1.2 <=2.5.6.SEC03)

org.springframework:spring-core MAVEN version =1.2, =1.1, =1.3, =0.0.1, =1.0, =0.3, =1.0, =0.0.1, =1.2.1, =1.2.1, =1.0, =1.0.4 - cf.pgmann.plugins:url-auth-sso =1.0 and more Source cves: CVE-2009-1190 Source advisory: OSV:GHSA-WJJR-H4WH-W6VV...

Amazon Linux 2 : java-1.8.0-amazon-corretto (ALASCORRETTO8-2022-002)

The version of java-1.8.0-amazon-corretto installed on the remote host is prior to 1.8.0332.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2CORRETTO8-2022-002 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle...

ASB-A-220741611

In multiple functions of ioviter.c, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege in system libraries with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2021-42001

PingID Desktop versions prior to 1.7.3 suffer a misconfiguration in the encryption libraries that can lead to exposure of sensitive data. The vulnerability could allow an attacker to complete an MFA challenge via OTP. Affected software: PingID Desktop. Root cause: misconfigured encryption librari...

SUSE SLES12 Security Update : java-11-openjdk (SUSE-SU-2022:1474-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1474-1 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JAXP. Supported...

IBM Java 7.0 < 7.0.10.55 / 7.1 < 7.1.4.55 / 8.0 < 8.0.6.10 Multiple Vulnerabilities

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.55 / 7.1 7.1.4.55 / 8.0 8.0.6.10. It is, therefore, affected by multiple vulnerabilities as referenced in the Oracle October 15 2019 CPU advisory. - Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE...