Code injection

Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get...

CVE-2023-5764

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data...

CVE-2023-29045

Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborati...

PT-2023-22109 · Ox Software Gmbh +1 · Ox App Suite +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Documents operations, specifically "drawing", could be manipulated to contain invalid data types, possibly script code. This script code could be inject...

Amazon Linux 2 : libguestfs-winsupport (ALAS-2023-2332)

The version of libguestfs-winsupport installed on the remote host is prior to 7.2-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2332 advisory. An invalid return code in fusekernmount enables intercepting of libfuse-lite protocol traffic between NTFS-3G...

Amazon Linux 2 : opensc (ALAS-2023-2323)

The version of opensc installed on the remote host is prior to 0.19.0-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2323 advisory. Potential PIN bypass.When the token/card was plugged into the computer and authenticated from one process, it could be use...

CVE-2023-29044: Improper Neutralization of Input During Web Page Generation

Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be executed for users that are actively collaborating on the same document. Operation data exchanged between collaborating parties does now get...

RHEL 8 : insights-client (RHSA-2023:6284)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6284 advisory. Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights- client package can gather the required data...

RHEL 8 : insights-client (RHSA-2023:6264)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6264 advisory. Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights- client package can gather the required data...

RHEL 9 : insights-client (RHSA-2023:6282)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6282 advisory. Red Hat Insights is a service that provides analysis of registered Red Hat-based systems. The insights- client package can gather the required data...

USN-6454-4: Linux kernel (StarFive) vulnerabilities

Kyle Zeng discovered that the netfilter subsystem in the Linux kernel contained a race condition in IP set operations in certain situations. A local attacker could use this to cause a denial of service system crash. CVE-2023-42756 Alex Birnberg discovered that the netfilter subsystem in the Linux...

Design/Logic Flaw

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

CVE-2023-3972 Insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

CVE-2023-3972 Insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

CVE-2023-3972

CVE-2023-3972 affects the insights-client in TencentOS Server (2 and 3). The issue arises from insecure file operations/handling of temporary files, allowing an unprivileged local user to create the /var/tmp/insights-client directory before root registers the insights-client. After registration b...

CVE-2023-3972 Insights-client: unsafe handling of temporary files and directories

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

CVE-2023-3972

A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local...

Medium: opensc

Issue Overview: Potential PIN bypass. When the token/card was plugged into the computer and authenticated from one process, it could be used to provide cryptographic operations from different process when the empty, zero-length PIN and the token can track the login status using some of its...

Medium: libguestfs-winsupport

Issue Overview: An invalid return code in fusekernmount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. CVE-2022-30783 A crafted NTFS image can cause heap exhaustion in ntfsgetattributevalue in NTFS-3G...

Hitachi Energy Electronic Shift Operations Management System Security Vulnerability

Hitachi Energy Electronic Shift Operations Management System is Hitachi's management platform for ensuring the safe, efficient and reliable operation and maintenance of mission-critical plant facilities and assets. A security vulnerability exists in Hitachi Energy Electronic Shift Operations...