Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to multiple vulnerabilities

Summary There are multiple vulnerabilities in components of IBM i Modernization Engine for Lifecycle Integration as described in the Vulnerability Details section. FasterXML jackson-databind, Keycloak, and SnakeYAML are vulnerable to a denial of service CVE-2022-25857, CVE-2022-38751,...

Security Updates for Microsoft Office Products (Nov 2022) (macOS)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability in Microsoft Word. CVE-2022-41061 - A remote code execution vulnerability in Microsoft Office Graphics. CVE-2022-41107 Note that Nessus has n...

SUSE SLES15 Security Update : kernel (Live Patch 24 for SLE 15 SP3) (SUSE-SU-2022:4516-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4516-1 advisory. This update for the Linux Kernel 5.3.18-1503005993 fixes several issues. The following security issues were fixed: - CVE-2022-43945: Fixed a...

Rocky Linux 8 : nodejs:16 (RLSA-2022:9073)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:9073 advisory. - Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95. CVE-2021-44906 Note that Nessus has not tested for this...

Microsoft Security Update Validation Report December 2022

Microsoft’s December 2022 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing softwa...

Samba Releases Security Updates

The Samba Team has released security updates to address vulnerabilities in multiple versions of Samba. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Samba security announcements and...

nodejs:16 security, bug fix, and enhancement update

An update is available for nodejs-nodemon, nodejs, nodejs-packaging. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a software development platform f...

Drupal Releases Security Updates to Address Vulnerabilities in H5P and File (Field) Paths

Drupal has released security updates to address vulnerabilities affecting H5P and the File Field Paths modules for Drupal 7.x. An attacker could exploit these vulnerabilities to access sensitive information and remotely execute code. CISA encourages users and administrators to review Drupal’s...

Zoom Client for Meetings < 5.8.4 Vulnerability (ZSB-21019)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.8.4. It is, therefore, affected by a vulnerability as referenced in the ZSB-21019 advisory. - A buffer overflow vulnerability was discovered in the products listed in the Affected Products'' section of this bulleti...

Zoom Client for Meetings < 5.11.0 Vulnerability (ZSB-22016)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.11.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-22016 advisory. - The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.11.0 are susceptible to a URL...

Zoom Client for Meetings < 5.9.7 Vulnerability (ZSB-22004)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.9.7. It is, therefore, affected by a vulnerability as referenced in the ZSB-22004 advisory. - The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to...

Zoom Client for Meetings < 5.10.3 Vulnerability (ZSB-22010)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.10.3. It is, therefore, affected by a vulnerability as referenced in the ZSB-22010 advisory. - The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting witho...

Zoom Client for Meetings < 5.10.0 Vulnerability (ZSB-22008)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.10.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-22008 advisory. - The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before...

Zoom Client for Meetings < 5.12.6 Vulnerability (ZSB-22025)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.12.6. It is, therefore, affected by a vulnerability as referenced in the ZSB-22025 advisory. - The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.6 is susceptible to a loca...

Security Updates for Microsoft ASP.NET Core (December 2022)

A remote code execution vulnerability exists in ASP.NET core 3.1, ASP.NET 6.0, and ASP.NET 7.0, where a malicious actor could cause a user to run arbitrary code as a result of parsing maliciously crafted xps files. Note that Nessus has not tested for this issue but has instead relied only on the...

Zoom Client for Meetings < 5.12.2 Vulnerability (ZSB-22024)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.12.2. It is, therefore, affected by a vulnerability as referenced in the ZSB-22024 advisory. - The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.2 is susceptible to a URL...

Zoom Client for Meetings < 5.2.0 Vulnerability (ZSB-21005)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.2.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-21005 advisory. - It was discovered that the installation packages of the Zoom Client for Meetings for macOS Standard and for IT Admin...

Zoom Client for Meetings < 5.10.0 Vulnerability (ZSB-22007)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.10.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-22007 advisory. - The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.10.0 fails to properly...

Zoom Client for Meetings < 5.12.6 Vulnerability (ZSB-22027)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.12.6. It is, therefore, affected by a vulnerability as referenced in the ZSB-22027 advisory. - Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version...

Zoom Client for Meetings < 4.1.34475.1105 Vulnerability (ZSB-18001)

The version of Zoom Client for Meetings installed on the remote host is prior to 4.1.34475.1105. It is, therefore, affected by a vulnerability as referenced in the ZSB-18001 advisory. - A vulnerability in the Zoom client could allow a remote, unauthenticated attacker to control meeting...