This Week in Spring - December 6th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? You know what Ive wanted to do? See my friends on the Spring team in person since the pandemic descended. And, Im overjoyed to relate, Ive just had the privilege of a nice meeting with several of them last night...

[SECURITY] Fedora 35 Update: libetpan-1.9.4-9.fc35

The purpose of this mail library is to provide a portable, efficient middle-w are for different kinds of mail access. When using the drivers interface, the interface is the same for all kinds of mail access, remote and local mailboxe s...

[SECURITY] Fedora 37 Update: libetpan-1.9.4-9.fc37

The purpose of this mail library is to provide a portable, efficient middle-w are for different kinds of mail access. When using the drivers interface, the interface is the same for all kinds of mail access, remote and local mailboxe s...

Fedora: Security Advisory for libetpan (FEDORA-2022-f092bc8f7b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for libetpan (FEDORA-2022-df2f4923ea)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

A Bootiful Podcast: Java Champion Gunnar Morling about messaging middleware, Debezium, change data capture, and more.

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Java Champion Gunnar Morling @gunnarmorling about messaging middleware, Debezium, and more...

CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a critical flaw impacting Oracle Fusion Middleware to its Known Exploited Vulnerabilities KEV Catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2021-35587, carries a CVSS score of 9.8 a...

VulnCheck KEV: CVE-2021-35587

Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product...

Oracle Fusion Middleware Unspecified Vulnerability

Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product...

Malicious code in geocaching-express-account-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fd22154955291fe6ddada5958c76a297f2e37a290111d05c984707ff2b2be18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

FreeBSD : Grafana -- Privilege escalation (db895ed0-6298-11ed-9ca2-6c3be5272acd)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db895ed0-6298-11ed-9ca2-6c3be5272acd advisory. - Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and...

Grafana Competition Conditions Vulnerability

Grafana is a Grafana open source set of open source monitoring tools that provide a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. Grafana has a contention condition vulnerability that stems from the inclusion of a contention...

CVE-2022-39328

A race condition was found in Grafana in the middleware logic that could allow bypassing authentication. This flaw allows an unauthenticated user to successfully query an administration endpoint under a heavy load by using a load testing script hitting specific endpoints...

UBUNTU-CVE-2022-39328

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

Grafana 竞争条件问题漏洞

Grafana is a Grafana open source set of open source monitoring tools that provide a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. Grafana has a contention condition vulnerability that stems from the inclusion of a contention...

CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

CVE-2022-39328

Grafana CVE-2022-39328: A race condition in the authentication middlewares logic affects Grafana versions 9.2.0 up to but not including 9.2.4, potentially allowing an unauthenticated user to query an administration endpoint under heavy load. The issue is patched in Grafana 9.2.4. There are no pub...

CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

Denial of Service (DoS)

Overview vapor/vapor is an a server-side Swift HTTP web framework. Affected versions of this package are vulnerable to Denial of Service DoS in Vapor's HTTP Range Request, when FileMiddleware is enabled. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...

rubygem-rack: crafted requests can cause shell escape sequences

A flaw was found in ruby gem-rack. This flaw allows a malicious actor to craft requests that can cause shell escape sequences to be written to the terminal via rack's Lint middleware and CommonLogger middleware. This issue can leverage these escape sequences to execute commands in the victim's...