Experts Discover Flaw in U.S. Govt's Chosen Quantum-Resistant Encryption Algorithm

A group of researchers has revealed what it says is a vulnerability in a specific implementation of CRYSTALS-Kyber , one of the encryption algorithms chosen by the U.S. government as quantum-resistant last year. The exploit relates to "side-channel attacks on up to the fifth-order masked...

SUSE CVE-2008-1688

Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries...

SUSE CVE-2008-1687

The 1 maketemp and 2 mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename...

SUSE CVE-2015-5195

ntpopenssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service segmentation fault via a crafted statistics or filegen configuration command that is not enabled during compilation...

CVE-2023-0301 Cross-site Scripting (XSS) - Stored in alfio-event/alf.io

Cross-site Scripting XSS - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301...

CVE-2023-0300 Cross-site Scripting (XSS) - Reflected in alfio-event/alf.io

Cross-site Scripting XSS - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301...

PT-2023-16155 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alf.io versions prior to 2.0-M4-2301 Description: The issue is related to Cross-site Scripting XSS - Reflected. This is a type of security vulnerability that occurs when an application includes user input in its responses without properly...

This Week in Spring - August 1st, 2022

Aloha, Spring fans! Welcome to another installment of This Week in Spring! Im still on vacation on the beautiful island of Maui, Hawaii, but I wanted to say hello "aloha!" and share this weeks latest roundup of all thats good and glorious in the wide and wonderful world of Springdom. Funny thing,...

org.apache.jspwiki.it:jspwiki-it-builder (>=2.11.0 <=2.11.0.M4), org.apache.jspwiki.it:jspwiki-it-test-cma (>=2.11.0 <=2.11.0.M4) +8 more potentially affected by CVE-2019-12407 via org.apache.jspwiki:jspwiki-war (>=2.10.0 <=2.11.0.M4)

org.apache.jspwiki:jspwiki-war MAVEN version =2.10.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.10.0, =2.10.3, =2.10.5 - org.apache.jspwiki:jspwiki-portable =2.11.0 Source cves: CVE-2019-12407 Source advisory: OSV:GHSA-P2R4-RPJ8-M2P9...

Cross-site Scripting in Apache JSPWiki

In Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive...

new packages: m4

An update is available for m4. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.0 Relea...

Fixed in Apache Tomcat 10.0.0-M5

Important: Remote Code Execution via session persistence CVE-2020-9484 If: an attacker is able to control the contents and name of a file on the server; and the server is configured to use the PersistenceManager with a FileStore; and the PersistenceManager is configured with...

Cross-site scripting in Apache JSPWiki

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...

GHSA-G6WW-2X43-H963 Cross-site scripting in Apache JSPWiki

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victi...

CVE-2019-12407

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive...

CVE-2019-10090

CVE-2019-10090 affects Apache JSPWiki up to version 2.11.0.M4. The vulnerability is an XSS flaw triggered by a crafted plugin link invocation related to the plain editor, allowing an attacker to execute JavaScript in the victim’s browser and potentially view sensitive information. The available c...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM System x, BladeCenter and Flex Systems Unified Extensible Firmware Interface (UEFI) (CVE-2015-0286 CVE-2015-0288 CVE-2015-0289 CVE-2015-0209 CVE-2015-0287)

Summary OpenSSL vulnerabilities were disclosed on March 19th, 2015 by the OpenSSL Project. OpenSSL is used by IBM System x, BladeCenter and Flex Systems Unified Extensible Firmware Interface UEFI. IBM System x, BladeCenter and Flex Systems UEFI have addressedthe applicable CVEs. Vulnerability...

Security Bulletin: IBM QRadar SIEM has released 7.3.1 Patch 4, and 7.2.8 Patch 13 in response to the vulnerabilities known as Spectre and Meltdown.

Summary IBM has released the following 7.3.1 Patch 4, and 7.2.8 Patch 13 for IBM QRadar SIEM in response to CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754 Vulnerability Details CVEID: CVE-2017-5753 CVEID: CVE-2017-5715 CVEID: CVE-2017-5754 Affected Products and Versions IBM QRadar SIEM 7.3.0 –...

m4-tv.com XSS vulnerability

Open Bug Bounty ID: OBB-659636 Description| Value ---|--- Affected Website:| m4-tv.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Security Bulletin: IBM X Series hardware IMMv1, IMMv2 remote management ports as used by IBM QRadar SIEM appliances are affected by the following OpenSSL vulnerabilities: (CVE-2014-0224)

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients an...