CVE-2024-21490

This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in...

IBM Semeru Runtime Encryption Issue Vulnerability

IBM Semeru Runtime is a Java Runtime Environment JRE from International Business Machines IBM. IBM Semeru Runtime suffers from a cryptographic issue vulnerability that stems from the use of weaker-than-expected encryption algorithms that could allow an attacker to decrypt highly sensitive...

Security Bulletin: Multiple vulnerabilities affect IBM® Semeru Runtime

Summary This bulletin covers all applicable Java SE CVEs published by OpenJDK as part of their January 2024 Vulnerability Advisory, plus CVE-2024-22361. For more information please refer to OpenJDK's January 2024 Vulnerability Advisory and the X-Force database entries referenced below...

Security Bulletin: IBM Sterling Transformation Extender is vulnerable to multiple issues in IBM Java Runtime Environment

Summary IBM Sterling Transformation Extender is vulnerable to multiple issues in IBM Java Runtime Environment Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality...

PT-2024-21581 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a bogus requirement added for runtime PM managed devices to be in the RPM ACTIVE state for PME polling. In fact, only devices in low power states should be...

CentOS 8 : apr-util (CESA-2023:3109)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3109 advisory. - Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util allows an attacker to write beyond bounds of a...

Important: Red Hat Security Advisory: runc security update

An update for runc is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to a denial of service and integrity impact due to multiple vulnerabilities.

Summary IBM® SDK Java™ Technology Edition and IBM® Runtime Environment Java™ used by IBM i are vulnerable to a remote attacker causing a denial of service CVE-2023-22081 and CVE-2023-5676 and an integrity impact CVE-2023-22067 as described in the vulnerability details section. This bulletin...

CVE-2023-6028

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...

Cross site scripting

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...

CVE-2023-6028

CVE-2023-6028 affects B&R Automation Runtime; a reflected XSS vulnerability exists in the SVG version of the System Diagnostics Manager. Affected products/versions: B&R Automation Runtime versions

CVE-2024-0323

The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product clients...

Design/Logic Flaw

Use of a Broken or Risky Cryptographic Algorithm vulnerability in B&R Industrial Automation Automation Runtime SDM modules. The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws...

CVE-2024-0323

The CVE-2024-0323 entry affects the B&R Automation Runtime FTP server, where the FTP service supports insecure encryption mechanisms (SSLv3, TLS 1.0, TLS 1.1). Affected product: B&R Automation Runtime (FTP server). Documented impact: network-based attacker can perform man-in-the-middle attacks or...

B&R Industrial Automation GmbH Runtime Cross-Site Scripting Vulnerability

B&R Industrial Automation GmbH Runtime is a major component of AS from B&R Industrial Automation, an Austrian company. A cross-site scripting vulnerability exists in B&R Industrial Automation GmbH Runtime G4.93 and earlier versions, which originates from a vulnerability that could allow a remote...

B&R Industrial Automation GmbH Runtime Encryption Issue Vulnerability

B&R Industrial Automation GmbH Runtime is a major component of AS from B&R Industrial Automation, an Austrian company. A cryptographic issue vulnerability exists in B&R Industrial Automation GmbH Runtime versions 14.0 through 14.93, which arises from the use of corrupted or risky cryptographic...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Versions 8 used by IBM Installation Manager and IBM Packaging Utility. The IBM Installation Manager and IBM Packaging Utility have addressed the applicable CVEs and we recommend updating to the latest version to remediat...

Denial Of Service (DoS)

Bref is vulnerable to Denial Of Service DoS. The vulnerability is due to improper clean up of temporary files after processing a MultiPart requests when the Event-Driven Function runtime is utilized and the handler is a RequestHandlerInterface. This allows an attacker to fill the Lambda instance...

Important: runc security update

The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: runc: file descriptor leak CVE-2024-21626 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related...

Bref's Uploaded Files Not Deleted in Event-Driven Functions

Impacted Resources bref/src/Event/Http/Psr7Bridge.php:94-125 Description When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each...