SUSE SLES12 Security Update : prometheus-ha_cluster_exporter (SUSE-SU-2023:2745-1)

The remote SUSE Linux SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2745-1 advisory. - rebuild the package with the go 1.20 security release bsc1208296. Tenable has extracted the preceding description block directly from the SUSE...

MAL-2023-1902 Malicious code in matplotlb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a5230460f70d1de9cde080dfedaa2ca545ffd9e5179d0e7bc8ae0053481a3900 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Huawei HarmonyOS Security Bypass Vulnerability (CNVD-2023-15717)

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. A security bypass vulnerability exists in Huawei HarmonyOS, which stems from an improper interface permission verification in the application package management...

Huawei HarmonyOS 访问控制错误漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from the fact that some interfaces in the package management module are not authenticated an...

Huawei HarmonyOS 访问控制错误漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from the fact that some interfaces in the package management module are not authenticated an...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei, a Chinese company that provides a microkernel-based distributed operating system. A security bypass vulnerability exists in Huawei HarmonyOS, which stems from an improper interface permission verification in the application package management...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : dpkg (SUSE-SU-2022:4081-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4081-1 advisory. - CVE-2022-1664: Fixed a directory traversal vulnerability in Dpkg::Source::Archive bsc1199944. Tenable h...

AlmaLinux 9 : qemu-kvm (ALSA-2022:5263)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5263 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

tpm2-tools bug fix and enhancement update

An update is available for tpm2-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The tpm2-tools packages add a set of utilities for management and...

rpm bug fix and enhancement update

An update is available for rpm. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The RPM Package Manager RPM is a command-line driven package management system...

rpm bug fix and enhancement update

An update is available for rpm. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The RPM Package Manager RPM is a command-line driven package management system...

New Timing Attack Against NPM Registry API Could Expose Private Packages

A novel timing attack discovered against the npm's registry API can be exploited to potentially disclose private packages used by organizations, putting developers at risk of supply chain threats. "By creating a list of possible package names, threat actors can detect organizations' scoped privat...

Fedora: Security Advisory for python-pip (FEDORA-2022-c072cdc3c8)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:3314-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: drools: - CVE-2021-41411: XML External Entity injection in KieModuleModelImpl.java. bsc1200629 httpcomponents-asyncclient: - Provide maven metadata needed by other packages to build image-sync-formula: - Update to version 0.1.1661440526.b08d95b Add option t...

GHSA-98WM-3W3Q-MW94 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-5.0...

Ubuntu: Security Advisory (USN-4986-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 Security Update : dpkg (SUSE-SU-2022:2689-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:2689-1 advisory. - CVE-2022-1664: Fixed directory traversal vulnerability in Dpkg::Source::Archive bsc1199944. Tenable has extracted the preceding descriptio...

Ubuntu 16.04 ESM : dpkg vulnerability (USN-5446-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5446-2 advisory. USN-5446-1 fixed a vulnerability in dpkg. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the preceding description bloc...

USN-5446-2: dpkg vulnerability

USN-5446-1 fixed a vulnerability in dpkg. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Max Justicz discovered that dpkg incorrectly handled unpacking certain source packages. If a user or an automated system were tricked into unpacking a specially...

Directory Traversal

Debian package management system is vulnerable to Directory Traversal.The vulnerability comes into play when extracting untrusted source packages in v3 and v3 source package formats that include debian.tar which allows the attacker to send a specially crafted orig.tar and debian.tar tarbells...