CVE-2017-16032

CVE-2017-16032 is a DoS vulnerability in the brace-expansion component used by IBM MobileFirst Platform Foundation 8.x.x. The IBM bulletin lists brace-expansion as vulnerable to regular expression denial of service (ReDoS) via crafted arguments, with affected versions tied to IBM MobileFirst Plat...

ProxyShellMiner Exploits Windows Exchange Server Vulnerabilities for Cryptocurrency Mining

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ProxyShellMiner exploits Windows Exchange servers vulnerabilities, which are used to gain unauthorized access and compromise an organization, leading to the installation of cryptocurrency miners...

SUSE CVE-2014-3654

Multiple cross-site scripting XSS vulnerabilities in spacewalk-java 2.0.2 in Spacewalk and Red Hat Network RHN Satellite 5.5 and 5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 kickstart/cobbler/CustomSnippetList.do, 2...

SUSE CVE-2014-8183

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations...

SUSE CVE-2017-7538

A cross-site scripting XSS flaw was found in how an organization name is displayed in Satellite 5, before 5.8. A user able to change an organization's name could exploit this flaw to perform XSS attacks against other Satellite users...

SUSE CVE-2017-1000106

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue...

SUSE CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

SUSE CVE-2019-20397

A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution...

SUSE CVE-2021-36157

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that...

SUSE CVE-2022-4337

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

SUSE CVE-2022-4338

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2023-22245

CVE-2023-22245 is linked to Adobe Substance 3D Stager. The connected CNNVD entry reports a vulnerability in versions prior to 2.0.0 arising from an out-of-bounds write that can cause a memory leak. remediation noted by Adobe APSB23-16 involves a security update; updating to 2.0.0 or later is the ...

U.S. Dept Of Defense: Reflected XSS in ██████

A reflected XSS vulnerability was found on one of the subdomains of a system. The vulnerability was located in the emailbody parameter of the PreviewLetterhead.aspx page. An attacker could exploit this vulnerability to execute malicious scripts and steal user's cookies, launch phishing attacks, a...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2023:0362-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0362-1 advisory. - Version update from 8.5.13 to 8.5.15 jscPED-2617: CVE-2022-39306: Security fix for privilege...

CVE-2022-20363

CVE-2022-20363 appears in the Chromecast July 2022 bulletin under AMLogic with component U-Boot, classified as Elevation of Privilege (EoP) and rated High severity. The bulletin notes this family of issues is addressed by updating Chromecast devices to the 2022-02-05 patch level or newer. The vul...

CVE-2019-10521

CVE-2019-10521 is listed in the Pixel September 2020 bulletin under Qualcomm components, classified as N/A type with Kernel as the affected subcomponent and a Moderate severity. The entry references QC-CR#2419292 (Android bug/QC reference). The provided Connected document does not include a vulne...

CVE-2019-10519

CVE-2019-10519 is listed under Qualcomm components in Google's Pixel September 2020 security bulletin as a Moderate-severity, N/A-type issue affecting the Display/graphics component. The bulletin does not provide a detailed root cause or exploit information. There is no explicit patch description...

CVE-2021-0950

Android 12 security release notes list CVE-2021-0950 under System as a Elevation of Privilege (EoP) with Moderate impact. The entry confirms this CVE affects Android 12 components addressed in the Android 12 release, and notes that patches will be released to the Android Open Source Project (AOSP...

CVE-2021-0949

Android 12 release notes include CVE-2021-0949 in the System category. Details show: CVE-2021-0949, Android bug ID A-184658476, Type: Information Disclosure (ID), Severity: Moderate. The document lists it among the Android 12 vulnerability entries with no specific exploit details or remediation v...

CVE-2021-0886

CVE-2021-0886 is listed in the Android 12 security release notes under the System component as a DoS vulnerability (Severity: Moderate). The Android bulletin does not provide exploit details or specific mitigations for this CVE. It notes that issues addressed in Android 12 are protected if device...