GitLab 14.7 < 16.3.6 / 16.4.0 < 16.4.2 / 16.5.0 < 16.5.1 (CVE-2023-4700)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to run jobs in protected environments,...

SUSE-SU-2023:4357-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues: kubevirt is rebuilt against the current GO security release. - Set cache mode on hotplugge...

Updated nodejs packages fix security vulnerabilities

This is a security release. The following CVEs are fixed in this release: CVE-2023-44487: nghttp2 Security Release High CVE-2023-45143: undici Security Release High CVE-2023-38552: Integrity checks according to policies can be circumvented Medium CVE-2023-39333: Code injection via WebAssembly...

SUSE-SU-2023:4125-1 Security update for container-suseconnect

This update of container-suseconnect fixes the following issues: - rebuild the package with the go 1.21 security release bsc1212475...

PT-2023-36283 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...

SUSE-SU-2023:3952-2 Security update for runc

This update of runc fixes the following issues: - Update to runc v1.1.8. Upstream changelog is available from . - rebuild the package with the go 1.21 security release bsc1212475...

PT-2023-36273 · Runc · Runc

Name of the Vulnerable Software and Affected Versions: runc versions prior to 1.1.8 Description: The issue is related to the runc package, which has been updated to version 1.1.8. The update includes a rebuild of the package with the go 1.21 security release. Recommendations: For versions prior t...

PT-2023-36280 · Buildah +1 · Buildah +1

Name of the Vulnerable Software and Affected Versions: buildah affected versions not specified Description: The issue is related to a security release in go 1.21. The problem is addressed by rebuilding the package with this security release. Recommendations: At the moment, there is no information...

PT-2023-36282

Name of the Vulnerable Software and Affected Versions buildah affected versions not specified Description The issue is related to a security release in go 1.21. The problem is addressed by rebuilding the package with this security release. Recommendations At the moment, there is no information...

mantis -- multiple vulnerabilities

Mantis 2.25.8 release reports: Security and maintenance release 0032432: Update guzzlehttp/psr7 to 1.9.1 CVE-2023-29197 0032981: Information Leakage on DokuWiki Integration CVE-2023-44394...

PT-2023-36279 · Cni +1 · Cni +1

Name of the Vulnerable Software and Affected Versions: cni affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The estimated number of potentially affected devices worldwide is not available. There is no information...

Samba AD DC password exposure to privileged

Description In normal operation, passwords and most secrets are never disclosed over LDAP in Active Directory. However, due to a design flaw in Samba's implementation of the DirSync control, Active Directory accounts authorized to do some replication, but not to replicate sensitive attributes, ca...

SUSE-SU-2023:3952-1 Security update for runc

This update of runc fixes the following issues: - Update to runc v1.1.8. Upstream changelog is available from . - rebuild the package with the go 1.21 security release bsc1212475...

SUSE: Security Advisory (SUSE-SU-2023:3834-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-36267

Name of the Vulnerable Software and Affected Versions cni affected versions not specified Description The issue is related to a security release in the go 1.21 package, which is used to rebuild the cni package. Recommendations At the moment, there is no information about a newer version that...

Mageia: Security Advisory (MGASA-2023-0264)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled,...

Drupal 9.5.x < 9.5.11 / 10.x < 10.0.11 / 10.1.x < 10.1.4 Drupal Vulnerability (SA-CORE-2023-006)

According to its self-reported version, the instance of Drupal running on the remote web server is 9.5.x prior to 9.5.11, 10.x prior to 10.0.11, or 10.1.x prior to 10.1.4. It is, therefore, affected by a vulnerability. - In certain scenarios, Drupal's JSON:API module will output error backtraces...

PT-2023-36265 · Skopeo · Skopeo

Name of the Vulnerable Software and Affected Versions: skopeo affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.21. The skopeo package has been rebuilt with this security release to address the issue. There is no...

Vulnerability fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed a vulnerability in GitLab Enterprise Edition EE and Community Edition CE. A malicious person could exploit the vulnerability to execute pipelines with the privileges of an arbitrary user to execute pipelines. When this arbitrary user has elevated privileges, execution of code wit...