Security Bulletin: IBM Cloud Private is vulnerable to a Python vulnerability (CVE-2020-25659)

Summary IBM Cloud Private is vulnerable to a Python vulnerability Vulnerability Details CVEID: CVE-2020-25659 DESCRIPTION: python-cryptography could allow a remote attacker to obtain sensitive information, caused by a Bleichenbacher timing attack. By sending a specially-crafted request using the...

Security Bulletin: IBM Cloud Private is vulnerable to a Java vulnerability (CVE-2020-14782)

Summary IBM Cloud Private is vulnerable to a Java vulnerability Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and...

Security Bulletin: IBM Cloud Private is vulnerable to Java vulnerabilities (CVE-2020-14792, CVE-2020-14797, CVE-2020-14781, CVE-2020-14779, CVE-2020-14798, CVE-2020-14796)

Summary IBM Cloud Private is vulnerable to Java vulnerabilities Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of service resulting in a low...

Security Bulletin: IBM Cloud Private is vulnerable to Node.js vulnerabilities (CVE-2020-8201, CVE-2020-8252, CVE-2020-8251)

Summary IBM Cloud Private is vulnerable to Node.js vulnerabilities Vulnerability Details CVEID: CVE-2020-8201 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by CR-to-Hyphen conversion. By sending specially crafted HTTP request headers, an attacker could exploit this...

Security Bulletin: IBM Cloud Private is vulnerable to a WebSphere Application Server Liberty vulnerability (CVE-2020-4590)

Summary IBM Cloud Private is vulnerable to a WebSphere Application Server Liberty vulnerability Vulnerability Details CVEID: CVE-2020-4590 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 20.0.0.9 running oauth-2.0 or openidConnectServer-1.0 server features is vulnerable to ...

Security Bulletin: IBM Cloud Private is vulnerable to a Go vulnerability (CVE-2020-16845)

Summary IBM Cloud Private is vulnerable to a Go vulnerability Vulnerability Details CVEID: CVE-2020-16845 DESCRIPTION: Go Language is vulnerable to a denial of service, caused by an infinite read loop in ReadUvarint and ReadVarint in encoding/binary. By sending a specially-crafted input, a remote...

Security Bulletin: IBM Cloud Private is vulnerable to etcd vulnerabilities (CVE-2020-15106, CVE-2020-15112, CVE-2020-15113)

Summary IBM Cloud Private is vulnerable to etcd vulnerabilities Vulnerability Details CVEID: CVE-2020-15106 DESCRIPTION: etcd is vulnerable to a denial of service, caused by improper data validation in the decodeRecord method. By sending a specially crafted data, a remote authenticated attacker...

Security Bulletin: IBM Cloud Private is vulnerable to cURL vulnerabilities (CVE-2020-8169, CVE-2020-8177)

Summary IBM Cloud Private is vulnerable to cURL vulnerabilities Vulnerability Details CVEID: CVE-2020-8169 DESCRIPTION: cURL libcurl could allow a remote attacker to obtain sensitive information, caused by the failure to correctly URL encode the credential data when set using an curleasysetopt...

SUSE-SU-2021:0631-1 Security update for salt

This update for salt fixes the following issues: - Fix regression on cmd.run when passing tuples as cmd bsc1182740 - Allow extrafilerefs as sanitized kwargs for SSH client - Fix errors with virt.update - Fix for multiple for security issues CVE-2020-28243 CVE-2020-28972 CVE-2020-35662 CVE-2021-31...

Vulnerabilities fixed in MongoDB

Vulnerabilities have been fixed in MongoDB. The vulnerabilities allow an unauthorized remote malicious person to obtain opportunity to obtain sensitive data. The malicious party must perform a successful man-in-the-middle attack that undoes the encryption of data is undone. Exploiting this...

Vulnerabilities fixed in Adobe Bridge

Adobe has fixed vulnerabilities in Bridge. The vulnerabilities allow a remote malicious person to execute arbitrary execute arbitrary code under the victim's privileges. To exploit the vulnerability, the malicious party must cause the victim to induce malicious TTF files to be loaded. Adobe has...

Security Bulletin: IBM Cloud Private is vulnerable to a Node.js lodash vulnerability (CVEID: 183560)

Summary IBM Cloud Private is vulnerable to a Node.js lodash vulnerability Vulnerability Details Third Party Entry: 183560 DESCRIPTION: Node.js lodash module denial of service CVSS Base score: 7.5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/183560 for the current...

Security Bulletin: A Security Vulnerability affects IBM Cloud Private - OpenSSL (CVE-2019-1551)

Summary A Security Vulnerability affects IBM Cloud Private Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. By...

FreeBSD : FreeBSD -- jail_attach(2) relies on the caller to change the cwd (bba850fd-770e-11eb-b87a-901b0ef719ab)

When a process, such as jexec8 or killall1, calls jailattach2 to enter a jail, the jailed root can attach to it using ptrace2 before the current working directory is changed. Impact : A process with superuser privileges running inside a jail could change the root directory outside of the jail,...

Photon OS 1.0: Mysql PHSA-2021-1.0-0362

An update of the mysql package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0362. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid146863...

Cisco Releases Security Updates 

Cisco has released security updates to address vulnerabilities in Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Cisco Advisories and apply the necessary updates: Cisco...

Fedora 33 : php-horde-Horde-Text-Filter (2021-f8368da9af)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-f8368da9af advisory. - HordeTextFilter 2.3.7 mjr SECURITY: Fix XSS via Text2Html filter Reported by: Alex Birnberg, CVE 2021-26929 FEDORA-2021-f8368da9af Note that Nessus has not...

Fedora 32 : dotnet3.1 (2021-48ca39b6ad)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-48ca39b6ad advisory. - .NET Core and Visual Studio Denial of Service Vulnerability CVE-2021-1721 - .NET Core Remote Code Execution Vulnerability This CVE ID is unique fr...

Photon OS 1.0: Binutils PHSA-2021-1.0-0362

An update of the binutils package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0362. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Unbound PHSA-2021-1.0-0362

An update of the unbound package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-1.0-0362. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...