bouncycastle: potential blind LDAP injection attack using a self-signed certificate

A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update

A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain...

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain...

bouncycastle: potential blind LDAP injection attack using a self-signed certificate

A flaw was found in Bouncy Castle 1.73. This issue targets the fix of LDAP wild cards. Before the fix there was no validation for the X.500 name of any certificate, subject, or issuer, so the presence of a wild card may lead to information disclosure. This could allow a malicious user to obtain...

AlmaLinux 9 : squid (ALSA-2023:7465)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:7465 advisory. - Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug. CVE-2023-5824 Note that...

SUSE SLES15: libblkid-devel / libblkid-devel-static / libblkid1 / etc (SUSE-SU-2023:4512-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4512-1 advisory. - CVE-2018-7738: Fixed shell code injection in umount bash-completions bsc1213865. Tenable has extracted the preceding description block...

SUSE SLES15 Security Update : container-suseconnect (SUSE-SU-2023:4511-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4511-1 advisory. - rebuild the package with the go 1.21 security release bsc1212475. Tenable has extracted the preceding description block directly from the...

Server side request forgery (ssrf)

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for...

CVE-2023-48307 Nextcloud Mail app vulnerable to Server-Side Request Forgery

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for...

CVE-2023-48302 Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup Ctrl+Shift+V the...

RHEL 8 : linux-firmware (RHSA-2023:7401)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7401 advisory. The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fixes: hw amd: Retur...

Oracle Linux 8 : cups (ELSA-2023-7165)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7165 advisory. - CVE-2023-32360 cups: Information leak through Cups-Get-Document operation - CVE-2023-34241 cups: use-after-free in cupsdAcceptClient in...

RHEL 8 : kpatch-patch (RHSA-2023:7410)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7410 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...

RHEL 8 : fence-agents (RHSA-2023:7407)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7407 advisory. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or...

Debian DSA-5559-1 : wireshark - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5559 advisory. A vulnerability was discovered in the SSH dissector of Wireshark, a network protocol analyzer, which could result in denial of service or potentially the executio...

CBL Mariner 2.0 Security Update: memcached (CVE-2023-46853)

The version of memcached installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46853 advisory. - In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \...

Fedora 39 : dotnet6.0 (2023-1dd7cbebc9)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1dd7cbebc9 advisory. This is the October 24, 2023 release for .NET 6. Release Notes: https://github.com/dotnet/core/blob/main/release-notes/6.0/6.0.24/6.0.24.md Tenable has...

GHSA-4HH5-2678-83FX Cross-Site Request Forgery vulnerability in Prefect

An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API...

Oracle Linux 9 : flatpak (ELSA-2023-6518)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6518 advisory. 1.12.8-1 - Update to 1.12.8 CVE-2023-28100, CVE-2023-28101 Resolves: 2180312, 2221792 Tenable has extracted the preceding description block directly fr...