Medium: qt5-qtbase

Issue Overview: An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check. CVE-2023-51714 Affected Packages: qt5-qtbase...

Important: apache-ivy

Issue Overview: When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../" sequences - which ar...

Medium: cups

Issue Overview: OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer overflow vulnerability in the function formatlogline could allow remote attackers...

Low: vim

Issue Overview: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367. CVE-2023-1127 Affected Packages: vim Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run...

Medium: java-1.8.0-openjdk

Issue Overview: Improve CORBA communication: CORBA deserialization can result in outbound network connections with data passed in. CVE-2023-21830 Affected Packages: java-1.8.0-openjdk Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the differenc...

Low: openjpeg2

Issue Overview: A flaw was found in the opj2decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free on an uninitialized pointer, leading to a segmentation...

Critical: samba

Issue Overview: Out-of-bounds heap read/write vulnerability in VFS module vfsfruit allows code execution CVE-2021-44142 Affected Packages: samba Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Important: xorg-x11-server

Issue Overview: A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the SProcRenderCompositeGlyphs function due to improper validation of the request length. CVE-2021-4008 A flaw was found in xorg-x11-server. An out-of-bounds access can occur in the...

Scientific Linux Security Update : xstream on SL7.x (noarch) (2021:2683)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2021:2683-1 advisory. - XStream: remote command execution attack by manipulating the processed input stream CVE-2021-29505 Note that Nessus has not tested for this issue but ha...

Scientific Linux Security Update : tomcat on SL7.x (noarch) (2020:5020)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2020:5020-1 advisory. - tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling CVE-2020-1935 Note that Nessus has not tested for this issue but has...

Scientific Linux Security Update : postgresql-jdbc on SL6.x (noarch) (20200803)

Security Fixes : - postgresql-jdbc: XML external entity XXE vulnerability in PgSQLXML CVE-2020-13692 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid139353; scriptversion"1.3";...

Medium: python-rsa

Issue Overview: Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior...

Scientific Linux Security Update : apache-commons-beanutils on SL7.x (noarch) (20200121)

Security Fixes : - apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default CVE-2019-10086 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid133192; scriptversion"1.6";...

Scientific Linux Security Update : python-paramiko on SL7.x (noarch) (20181030)

Security Fixes : - python-paramiko: Authentication bypass in authhandler.py CVE-2018-1000805 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119197; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

CentOS Update for kernel CESA-2018:1852 centos7

Check the version of kernel SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882912";...

Scientific Linux Security Update : plexus-archiver on SL7.x (noarch) (20180612)

Security Fixes : - plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file CVE-2018-1002200 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid110508; scriptversion"1.5"...

Scientific Linux Security Update : xmlrpc3 on SL6.x (noarch) (20180531)

Security Fixes : - xmlrpc: Deserialization of untrusted Java object through tag CVE-2016-5003 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid110283; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

Low: tomcat7

Issue Overview: Incorrect documentation of CGI Servlet search algorithm may lead to misconfiguration: As part of the fix for bug 61201, the documentation for Apache Tomcat included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The upda...

Medium: cacti

Issue Overview: include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page. CVE-2017-15194 Affected Packages: cacti Issue Correction: Run yum update cacti or yum update --advisory ALAS-2017-923 to update your system. New Packages: noarch: ...

Medium: ruby22, ruby23

Issue Overview: SMTP command injection via CRLF sequences in RCPT TO or MAIL FROM commands in Net::SMTP A SMTP command injection flaw was found in the way Ruby's Net::SMTP module handled CRLF sequences in certain SMTP commands. An attacker could potentially use this flaw to inject SMTP commands i...