20084 matches found
Security Bulletin: Multiple vulnerabilities in open source libraries affect IBM® Db2® Federated.
Summary Multiple vulnerabilities in open source libraries affect IBM® Db2® Federated. These vulnerabilities were fixed in the images published on December 01, 2023 but the CVEs were not included in the bulletin. Vulnerability Details CVEID:CVE-2022-1471 DESCRIPTION: SnakeYaml could allow a remote...
Security Bulletin: Multiple vulnerabilities in open source libraries affect IBM® Db2® Federated.
Summary Multiple vulnerabilities in open source libraries affect IBM® Db2® Federated. Vulnerability Details CVEID:CVE-2023-1370 DESCRIPTION: netplex json-smart-v2 is vulnerable to a denial of service, caused by not limiting the nesting of arrays or objects. By sending a specially crafted input, a...
CVE-2023-47118
ClickHouse CVE-2023-47118 is a heap buffer overflow in the server’s decompression logic (T64 codec) that can be triggered by sending a crafted payload to the native interface on port 9000/tcp or via HTTP with valid credentials. The issue allows unauthenticated remote exploitation through the nati...
journalpump Information Disclosure Vulnerability
journalpump is an Aiven open source daemon that fetches log messages from Journald and pumps them to a given output. An information disclosure vulnerability exists in Journalpump versions prior to 2.5.0, which stems from logging the configuration of a service integration into the provided logging...
CVE-2023-48796
creationtimestamp| type| source ---|---|--- 2023-12-16 14:48:00+00:00| seen| https://t.me/ctinow/155412 2025-11-28 07:40:54+00:00| seen| https://seclists.org/oss-sec/2025/q4/215 2025-11-28 10:24:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m6oo6f2zvs2g 2026-04-09...
China's MIIT Introduces Color-Coded Action Plan for Data Security Incidents
China's Ministry of Industry and Information Technology MIIT on Friday unveiled draft proposals detailing its plans to tackle data security events in the country using a color-coded system. The effort is designed to "improve the comprehensive response capacity for data security incidents, to ensu...
[SECURITY] Fedora 38 Update: chromium-120.0.6099.109-1.fc38
Chromium is an open-source web browser, powered by WebKit Blink...
UnrealIRCd Security Vulnerability
UnrealIRCd is an open source IRC server from UnrealIRCd Open Source. A security vulnerability exists in UnrealIRCd versions 6.1.0 through 6.1.3, which stems from a buffer overflow vulnerability in websockets...
Security Bulletin: Vulnerability in Cryptography package for Python affects IBM Process Mining CVE-2023-49083
Summary There is a vulnerability in Cryptography package for Python that could allow an attacker to execute denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...
Security Bulletin: Vulnerability in Santuario affects IBM Process Mining CVE-2023-44483
Summary There is a vulnerability in Santuario that could allow a remote authenticated attacker to obtain sensitive information on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...
Security Bulletin: Vulnerability in PyArrow affects IBM Process Mining CVE-2023-47248
Summary There is a vulnerability in PyArrow that could allow an attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-47248 DESCRIPTION:...
Security Bulletin: Vulnerability in Brix crypto-js affects IBM Process Mining CVE-2023-46233
Summary There is a vulnerability in Brix crypto-js that could allow an remote attacker to obtain sensitive information. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-46233 DESCRIPTION...
Cross site request forgery (csrf)
Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...
CVE-2023-50715 User accounts disclosed to unauthenticated actors on the LAN
Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...
New Hacker Group GambleForce Hacks Targets with Open Source Tools
By Waqas Yet another day, yet another threat actor posing a danger to the cybersecurity of companies globally. This is a post from HackRead.com Read the original post: New Hacker Group GambleForce Hacks Targets with Open Source Tools...
Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server
Summary IBM Db2 is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 have been published in a security bulletin CVE-2015-8383, CVE-2015-8381, CVE-2015-8386, CVE-2015-8388, CVE-2015-8385, CVE-2015-8387, CVE-2015-8391, CVE-2015-8390, CVE-2015-839...
CVE-2023-49294
CVE-2023-49294 affects Asterisk: read arbitrary files when live_dangerously is not enabled. Affected versions are pre-18.20.1, pre-20.5.1, pre-21.0.1, and certified-asterisk before 18.9-cert6. The issue has a fix in 18.20.1, 20.5.1, 21.0.1, and certified-asterisk from 18.9-cert6 onward. Public ma...
CVE-2023-49294 Asterisk Path Traversal vulnerability
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the livedangerously is not enabled. This allows arbitrary fil...
New Hacker Group 'GambleForce' Tageting APAC Firms Using SQL Injection Attacks
A previously unknown hacker outfit called GambleForce has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific APAC region since at least September 2023. "GambleForce uses a set of basic yet very effective techniques, including SQL injections and th...