[SECURITY] Fedora 37 Update: python3.8-3.8.15-1.fc37

Python 3.8 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.8, see other distributions that support it, such as an older Fedora release...

DNS resolution issue with new 13.0.86.17 client

ADC version 13.0.86.17, with 'Citrix Secure Access' VPN client the same version, shows as version 22.2.1.103 in the client. The old client was 13.0.58.30 shown as 21.3.1.2 1. Some users report that on the new client they cannot resolve any DNS record...

PT-2022-19217 · Zoom · Zoom Client For Meetings +1

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings versions prior to 5.12.2 Description: The issue allows a malicious Zoom meeting URL to direct the user to connect to an arbitrary network address, potentially leading to additional attacks, including session takeovers...

[SECURITY] Fedora 36 Update: python3.6-3.6.15-12.fc36

Python 3.6 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.6, see other distributions that support it, such as CentOS or RHEL with Software...

AZL-33575 CVE-2022-32149 affecting package containerized-data-importer for versions less than 1.55.0-20

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...

PT-2022-19661 · Altair · Altair Hyperview Player

Name of the Vulnerable Software and Affected Versions: Altair HyperView Player versions 2021.1.0.27 and prior Description: The issue is related to the use of uninitialized memory during the parsing of H3D files. A DWORD is extracted from an uninitialized buffer, and after sign extension, it is us...

PT-2022-6445 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 FP2211 Description: An XXE issue was discovered via an XML document to the Configuration Dashboard page, where input validation and a proper XML parser configuration are missing. This makes it difficult for a...

Rocket.Chat 信息泄露漏洞

Rocket.Chat is an open source team chat software. A vulnerability exists in Rocket.Chat prior to version 5.0 due to an authorization issue, which stems from a leak in the getUserMentionsByChannel meteor server method that can be exploited by an attacker to obtain sensitive information...

CVE-2022-37146

The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the PlexTrac authentication provider. Login attempts for valid, unlocked users configured to use PlexTrac as their authentication provider ta...

ALPINE-CVE-2019-15167

The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrpprint for VRRP version 3, a different vulnerability than CVE-2018-14463...

node-opcua 资源管理错误漏洞

node-opcua is a French Sterfive SAS open source implementation of an OPC UA stack written entirely in Typescript for NodeJS. A resource management error vulnerability exists in versions of node-opcua prior to 2.74.0. An attacker can exploit this vulnerability to bypass excessive memory consumptio...

CVE-2022-2921

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update...

prometheus/client_golang: Denial of service using InstrumentHandlerCounter

A denial of service attack was found in prometheus/clientgolang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability...

UBUNTU-CVE-2022-2295

Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

PT-2022-4037 · Jenkins · Jenkins Deployer Framework Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Deployer Framework Plugin versions 85.v1d1888e8c021 and earlier Description: The issue is related to incorrect restriction of the directory path name with limited access. Exploitation of this issue may allow a remote attacker to gain...

CVE-2022-2239

The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Ping Identity Windows PingId 安全漏洞

Ping Identity Windows PingId is a software from Ping Identity USA that provides security for applications. A security vulnerability exists in Ping Identity Windows PingId versions prior to 2.8 that stems from the use of known vulnerable components that could lead to remote code execution...

CVE-2021-25104

The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue...

[SECURITY] Fedora 35 Update: python3.7-3.7.13-2.fc35

Python 3.7 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.7, see other distributions that support it, such as an older Fedora release...

[SECURITY] Fedora 36 Update: python3.8-3.8.13-3.fc36

Python 3.8 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.8, see other distributions that support it, such as an older Fedora release...