Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted query. (CVE-2023-43020)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted query. Vulnerability Details CVEID:CVE-2023-43020 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted query. CVSS Base score: 6.5 CVSS...

Security Bulletin: IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement. (CVE-2023-38727)

Summary IBM® Db2® is vulnerable to denial of service with a specially crafted SQL statement. Vulnerability Details CVEID:CVE-2023-38727 DESCRIPTION: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server is vulnerable to denial of service with a specially crafted SQL statement. CVSS Base...

Expanded Coverage and AWS Compliance Pack Updates in InsightCloudSec Coming Out of AWS Re:Invent 2023

It seems like it was just yesterday that we were in Las Vegas for AWS Re:Invent, but it’s already been almost two weeks since the conference wrapped up. As is always the case, AWS unveiled a host of new services throughout the week, including advancements around serverless, artificial intelligenc...

Malicious code in reduced-ui-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb32f57ffb8cf2bb877f64d7d6c9c15003011d5985401e6d7a9cd4e267a5c2d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8730 Malicious code in reduced-ui-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb32f57ffb8cf2bb877f64d7d6c9c15003011d5985401e6d7a9cd4e267a5c2d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in reduced-ui-pack

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

org.keycloak:keycloak-authz-policy-drools (6.0.0), org.keycloak:keycloak-dependencies-server-all (6.0.0) +8 more potentially affected by CVE-2023-6134 via org.keycloak:keycloak-services (6.0.0)

org.keycloak:keycloak-services MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 6.0.0 - org.keycloak:keycloak-dependencies-server-all 6.0...

org.keycloak:keycloak-authz-policy-drools (8.0.0), org.keycloak:keycloak-dependencies-server-all (8.0.0) +7 more potentially affected by CVE-2023-6134 via org.keycloak:keycloak-services (8.0.0)

org.keycloak:keycloak-services MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 8.0.0 - org.keycloak:keycloak-dependencies-server-all 8.0...

org.keycloak:keycloak-authz-policy-drools (3.2.0.final), org.keycloak:keycloak-dependencies-server-all (3.2.0.final) +6 more potentially affected by CVE-2023-6134 via org.keycloak:keycloak-services (3.2.0.final)

org.keycloak:keycloak-services MAVEN version 3.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.2.0.final -...

org.keycloak:keycloak-authz-policy-drools (3.4.1.cr1), org.keycloak:keycloak-dependencies-server-all (3.4.1.cr1) +6 more potentially affected by CVE-2023-6134 via org.keycloak:keycloak-services (3.4.1.cr1)

org.keycloak:keycloak-services MAVEN version 3.4.1.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.4.1.cr1 -...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by AIX. AIX has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM for JDK related to the JSSE component...

Cryptocurrency Widgets Pack Plugin SQL Injection

The vulnerability of the Cryptocurrency Widgets Pack plugin in the WordPress content management system is related to the lack of validation for the consistency of XML objects. Exploiting this vulnerability could allow a malicious actor to execute arbitrary SQL queries remotely...

Amazon Linux 2023 : aspnetcore-runtime-6.0, aspnetcore-targeting-pack-6.0, dotnet (ALAS2023-2023-457)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-457 advisory. .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability CVE-2023-36049 ASP.NET Core - Security Feature Bypass Vulnerability CVE-2023-36558 Tenable has extracted the precedi...

Security Bulletin: IBM MQ is vulnerable to a denial of service (CVE-2023-5072)

Summary IBM MQ has resolved a denial of service vulnerability. Vulnerability Details CVEID:CVE-2023-5072 DESCRIPTION: JSON-java is vulnerable to a denial of service, caused by a bug in the parser. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause ...

Security Bulletin: IBM MQ Appliance is vulnerable to a denial of service (CVE-2023-4807)

Summary IBM MQ Appliance has resolved a denial of service vulnerability. Vulnerability Details CVEID:CVE-2023-4807 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a state corruption flaw in the POLY1305 MAC message authentication code implementation, when running on newer X86...

Security Bulletin: IBM MQ Appliance is affected by multiple Java vulnerabilitites (CVE-2023-22081 and CVE-2023-5676)

Summary IBM MQ Appliance has resolved multiple Java vulnerabilities. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality impact, no integrity impact, and low...

dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11), dk.grinn.keycloak:keycloak-migrate-spi (>=0.0.6, <=1.0.11) +3 more potentially affected by CVE-2023-6563 via org.keycloak:keycloak-model-jpa (6.0.1)

org.keycloak:keycloak-model-jpa MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - dk.grinn.keycloak:keycloak-migrate-resource =0.0.6, =0.0.6, =1.0.11 -...

org.keycloak:keycloak-dependencies-server-all (11.0.2), org.keycloak:keycloak-server-feature-pack (11.0.2) +2 more potentially affected by CVE-2023-6563 via org.keycloak:keycloak-model-jpa (11.0.2)

org.keycloak:keycloak-model-jpa MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.keycloak:keycloak-dependencies-server-all 11.0.2 - org.keycloak:keycloak-server-feature-pack...

org.keycloak:keycloak-dependencies-server-all (3.4.0.cr1), org.keycloak:keycloak-server-feature-pack (3.4.0.cr1) +1 more potentially affected by CVE-2023-6563 via org.keycloak:keycloak-model-jpa (3.4.0.cr1)

org.keycloak:keycloak-model-jpa MAVEN version 3.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.4.0.cr1 -...

org.keycloak:keycloak-dependencies-server-all (10.0.0), org.keycloak:keycloak-server-feature-pack (10.0.0) +1 more potentially affected by CVE-2023-6563 via org.keycloak:keycloak-model-jpa (10.0.0)

org.keycloak:keycloak-model-jpa MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.0 - org.keycloak:keycloak-server-feature-pack...