[R2] Nessus Version 10.4.3 Fixes Multiple Vulnerabilities

R2 Nessus Version 10.4.3 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 03/07/2023 - 11:30 Nessus leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made availabl...

Security Bulletin: IBM DataPower Gateway potentially vulnerable to Denial of Service (CVE-2022-4450)

Summary IBM has addressed the CVE Vulnerability Details CVEID:CVE-2022-4450 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error related to the improper handling of specific PEM data by the PEMreadbioex function. By sending specially crafted PEM files for...

Security Bulletin: IBM Observability with Instana (OnPrem) affected by OpenSSL vulnerabilities.

Summary IBM Observability with Instana OnPrem has addressed the following OpenSSL vulnerabilities in it's self-hosted Docker-based installer: CVE-2022-3602 and CVE-2022-3786. Vulnerability Details CVEID:CVE-2022-3602 DESCRIPTION: OpenSSL is vulnerable to a stack-based buffer overflow, caused by...

Tenable Nessus < 10.5.0 Multiple Vulnerabilities (TNS-2023-09)

Tenable Nessus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessus"; ifdescripti...

[R2] Nessus Version 8.15.9 Fixes Multiple Vulnerabilities

R2 Nessus Version 8.15.9 Fixes Multiple Vulnerabilities Arnie Cabral Mon, 03/06/2023 - 18:07 Nessus leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made availabl...

NULL Pointer Dereference

openssl is vulnerable to NULL Pointer Dereference. The vulnerability exists because there is a missing check network subcomponent in the Linux kernel, which later leads to invalid usage of the digest api most likely leading to a crash...

Hitachi Energy Gateway Station

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Gateway Station GWS Vulnerabilities: NULL Pointer Dereference, Infinite Loop 2. RISK EVALUATION Successful exploitation of these vulnerabilities could cause affected modules to...

Security Bulletin: Vulnerabilities in OpenSSL affect Bluemix Workflow (CVE-2014-3570, CVE-2014-3571, CVE-2014-3572, CVE-2014-8275, CVE-2015-204, CVE-2015-205, CVE-2015-206)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes the vulnerability that has been referred to as “FREAK”. OpenSSL is used by Bluemix Workflow for internal communication. Bluemix Workflow has addressed the applicable CVEs. Vulnerability Details...

Tenable Nessus <= 10.4.2 Multiple Vulnerabilities (TNS-2023-09)

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.4.2 or earlier. It is, therefore, affected by multiple vulnerabilities in OpenSSL prior to version 3.0.8, spin.js prior to version 2.3.2, and datatables.net prior to version 1.13.2: - An attack...

Tenable SecurityCenter <= 5.23.1 Multiple Vulnerabilities (TNS-2023-08)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is running a version between 5.21.0 and 5.23.1 and is therefore affected by multiple vulnerabilities in OpenSSL prior to version 1.1.1t: - A timing based side channel exists in the OpenSSL...

Tenable SecurityCenter 6.0.0 Multiple Vulnerabilities (TNS-2023-07)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is running 6.0.0 and is therefore affected by multiple vulnerabilities in OpenSSL prior to version 3.0.8: - An attacker that had observed a genuine connection between a client and a server...

Fedora 36 : edk2 (2023-e821b64a4c)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e821b64a4c advisory. add sub-package with xen build resolves: rhbz2170730 ---- update openssl CVE-2023-0286, CVE-2023-0215, CVE-2022-4450, CVE-2022-4304. ---- cherry-pic...

Insecure Random Number Generator

lemur is vulnerable to an Insecure Random Number Generator. The vulnerability is due to the getpsuedorandomstring function in utils.py, caused to the usage of the insecure random library, which can result in authentication bypass in multiple services. The random library was used to generate the...

OESA-2023-1135 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: The public API function BIOnewNDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, C...

CVE-2023-26490 mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync​

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to...

Security Bulletin: IBM Sterling Connect:Express for UNIX is affected by multiple vulnerabilities in OpenSSL

Summary A number of security vulnerabilities have been discovered in the OpenSSL libraries included in IBM Sterling Connect:Express for UNIX. Vulnerability Details CVEID:CVE-2022-4304 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing-based side...

SUSE-SU-2023:0609-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: Update to LTS version 16.19.1: - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule bsc1208481. - CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library bsc1208483. -...

SUSE-SU-2023:0608-1 Security update for nodejs16

This update for nodejs16 fixes the following issues: Update to LTS version 16.19.1: - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule bsc1208481. - CVE-2023-23919: Fixed OpenSSL error handling issues in nodejs crypto library bsc1208483. -...

PT-2023-20680 · Mailcow +3 · Mailcow +3

Name of the Vulnerable Software and Affected Versions: mailcow versions prior to the 2023-03 Update Description: The Sync Job feature in mailcow, a dockerized email package, suffers from a shell command injection. This allows a malicious user to obtain shell access to the Docker container running...

[R2] Nessus Version 10.5.0 Fixes Multiple Vulnerabilities

R2 Nessus Version 10.5.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 03/02/2023 - 12:42 Nessus leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, spin.js, datatables.net were found to contain vulnerabilities, and updated...