CentOS 8 : container-tools:2.0 (CESA-2022:1566)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1566 advisory. - podman: Default inheritable capabilities for linux container should be empty CVE-2022-27649 - buildah: Default inheritable capabilities for linux...

RHEL 8 : kernel (RHSA-2022:1550)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1550 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use-after-free in RDMA listen...

CentOS 8 : container-tools:3.0 (CESA-2022:1565)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:1565 advisory. - podman: Default inheritable capabilities for linux container should be empty CVE-2022-27649 - buildah: Default inheritable capabilities for linux...

SUSE-SU-2022:1402-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-28356: Fixed a refcount bug in llcuibind and llcuiautobind which could allow an unprivileged user to execute a DoS. bnc1197391 - CVE-2022-1016: Fixed...

Microsoft Patch Tuesday April 2022 and custom CVE comments sources in Vulristics

Hello everyone! This episode will be about Microsoft Patch Tuesday for April 2022 and new improvements in my Vulristics project. I decided to add more comment sources. Because its not just Tenable, Qualys, Rapid7 and ZDI make Microsoft Patch Tuesday reviews, but also other security companies and...

Security Bulletin: IBM Planning Analytics is affected by security vulnerabilities.

Summary This Security Bulletin addresses multiple vulnerabilities that have been remediated in IBM Planning Analytics Workspace 2.0.75. Vulnerability Details CVEID: CVE-2021-39040 DESCRIPTION: IBM Planning Analytics could be vulnerable to malicious file upload by not validating the file types or...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server (CVE-2021-39031)

Summary Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server Vulnerability Details CVEID: CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to conduct an LDAP injection. By...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - zabbix-agent2 package for Alpine Linux (CVE-2022-22704)

Summary Security Vulnerabilities affect IBM Cloud Private - zabbix-agent2 package for Alpine Linux Vulnerability Details CVEID: CVE-2022-22704 DESCRIPTION: zabbix-agent2 package for Alpine Linux could allow a remote authenticated attacker to gain elevated privileges on the system, caused by a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-44716, CVE-2021-44717)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-44716 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an uncontrolled memory consumption in the header canonicalization cache in net/http. By sending HTTP/2 requests, a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-41772,CVE-2021-41771)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-41772 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an out-of-bounds slice situation in the Reader.Open function. By using a specially-crafted ZIP archive containing a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-22959, CVE-2021-22960)

Summary Security Vulnerabilities affect IBM Cloud Private - Node.js Vulnerability Details CVEID: CVE-2021-22959 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by an error related to a space in headers. A remote attacker could send a specially-crafted request with a space SP...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Kubernetes (CVE-2021-25741)

Summary Security Vulnerabilities affect IBM Cloud Private - Kubernetes Vulnerability Details CVEID: CVE-2021-25741 DESCRIPTION: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a symlink exchange flaw in kubelet. By sending a specially-crafted...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22945)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22945 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by a use-after-free and double free flaw when sending data to an MQTT server. By sending a specially-crafted data, a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22946)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22946 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by a required TLS bypassed issue. By sniffing the network, an attacker could exploit this...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Apache Commons Compress (CVE-2021-35517, CVE-2021-36090)

Summary Security Vulnerabilities affect IBM Cloud Private - Apache Commons Compress Vulnerability Details CVEID:CVE-2021-35517 DESCRIPTION: Apache Commons Compress is vulnerable to a denial of service, caused by an out of memory error when allocating large amounts of memory. By persuading a victi...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server (CVE-2021-29842)

Summary Security Vulnerabilities affect IBM Cloud Private - IBM WebSphere Application Server Vulnerability Details CVEID: CVE-2021-29842 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39135)

Summary Security Vulnerabilities affect IBM Cloud Private - Node.js Vulnerability Details CVEID: CVE-2021-39135 DESCRIPTION: Node.js @npmcli/arborist module could allow a local attacker to launch a symlink attack. By replacing the nodemodules folder of the root project or any of its dependencies...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Java (Multiple CVEs)

Summary Security Vulnerabilities affect IBM Cloud Private - Java Vulnerability Details CVEID: CVE-2021-2388 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow an unauthenticated attacker to take control of the system. CVSS Base score: 7.5 CVSS Temporal...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Golang (CVE-2021-33196)

Summary Security Vulnerabilities affect IBM Cloud Private - Golang Vulnerability Details CVEID: CVE-2021-33196 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the NewReader and OpenReader functions in archive/zip. By persuading a victim to open a specially-crafted...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (CVE-2021-22924)

Summary Security Vulnerabilities affect IBM Cloud Private - curl Vulnerability Details CVEID: CVE-2021-22924 DESCRIPTION: An unspecified error with bad connection reused due to improper path name validation in cURL libcurl has an unknown impact and attack vector. CVSS Base score: 5.3 CVSS Tempora...