Oracle MySQL Server 5.7.x < 5.7.43 (October 2023 CPU)

The versions of MySQL Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Packaging OpenSSL. Supported versions that are affected are 5.7.42 and...

Medium: python-wheel

Issue Overview: An issue discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. CVE-2022-40898 Affected Packages: python-wheel Issue Correction: Run dnf update python-wheel --releaseve...

WordPress Printus - Cloud Printing Plugin for WooCommerce - Print WooCommerce PDF Invoices, Orders, Packaging Slips & More Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software Printus - Cloud Printing Plugin for WooCommerce - Print WooCommerce PDF Invoices, Orders, Packaging Slips & More Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severit...

CLSA-2023-1689009395 Fix of 9 CVEs

Backport upstream releases 8u372 to 16.04 LTS CVEs fixed in 8u372: - CVE-2023-21930: Improper connection handling during TLS handshake - CVE-2023-21937: Missing string checks for NULL characters - CVE-2023-21938: Incorrect handling of NULL characters in ProcessBuilder - CVE-2023-21939: Swing HTML...

AlmaLinux 8 : python38:3.8 and python38-devel:3.8 (ALSA-2023:3781)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3781 advisory. python: urllib.parse url blocklisting bypass CVE-2023-24329 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. No...

SUSE: Security Advisory (SUSE-SU-2023:2572-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-36197 · Unknown +1 · Python-Pyzmq +1

Name of the Vulnerable Software and Affected Versions: salt versions prior to 3006.0 python-pyzmq versions prior to 17.1.2 Description: The update for salt and python-pyzmq fixes several issues, including collections Mapping issues, conflicts with Salt dependencies versions, and failures due to t...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary IBM has addressed multiple vulnerabilities in IBM Spectrum Discover. Webpack loader-utils CVE-2022-37601 is vulnerable to execute arbitrary code on the system caused by a pollution flaw in parseQuery function. OpenStack Keystone CVE-2021-3563 is vulnerable to bypass security restriction...

Huawei EulerOS: Security Advisory for python-setuptools (EulerOS-SA-2023-2246)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.11.0 : python-setuptools (EulerOS-SA-2023-2111)

According to the versions of the python-setuptools packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML...

SUSE-SU-2023:2312-1 Security update for go1.18-openssl

This update for go1.18-openssl fixes the following issues: - Add subpackage go1.x-libstd compiled shared object libstd.so jscPED-1962 Main go1.x package included libstd.so in previous versions Split libstd.so into subpackage that can be installed standalone Continues the slimming down of main go1...

CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

nFPM 安全漏洞

nFPM is a GoReleaser open source simple deb, rpm and apk packaging program written in Go. There is a security vulnerability in nFPM that stems from the fact that anyone using nFPM to create packages without checking/setting file permissions prior to packaging can result in incorrect permissions o...

nfpm has incorrect default permissions

Summary When building packages directly from source control, file permissions on the checked-in files are not maintained. Details When building packages directly from source control, file permissions on the checked-in files are not maintained. When nfpm packaged the files without extra config for...

PT-2023-23971 · Nfpm · Nfpm

Name of the Vulnerable Software and Affected Versions: nfpm affected versions not specified Description: The issue arises when nfpm packages files without maintaining the original file permissions from the source control. This can result in files being packaged with incorrect permissions, such as...

nodejs:18 security, bug fix, and enhancement update

nodejs 1:18.14.2-2 - Provide simduft - Resolves: 2159389 1:18.14.2-1 - Rebase to 18.14.2 - Resolves: 2159389 - Resolves: CVE-2022-25881, CVE-2022-4904, CVE-2023-23936, CVE-2023-24807 - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920 nodejs-nodemon 2.0.20-2 - Patch bundled glob-parent -...

phoenixpackaging.com Cross Site Scripting vulnerability OBB-3334773

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of Python Packaging Authority’s installation tools is related to an incorrect regular expression, allowing a violator to trigger a service failure.

The vulnerability of Python Packaging Authority’s installation tools is related to insufficient input validation when processing HTML content. Exploiting this vulnerability allows a remote attacker to deliver specially crafted data to the application and perform a “denial-of-service” attack using...

SUSE-SU-2023:2127-1 Security update for go1.19

This update for go1.19 fixes the following issues: Update to 1.19.9 bnc1200441: - CVE-2023-24539: fixed an improper sanitization of CSS values bnc1211029. - CVE-2023-24540: fixed an improper handling of JavaScript whitespace bnc1211030. - CVE-2023-29400: fixed an improper handling of empty HTML...