SUSE-SU-2023:4908-1 Security update for mariadb

This update for mariadb fixes the following issues: - CVE-2023-22084: Fixed an easily exploitable vulnerability that allowed high privileged attacker with network access via multiple protocols to compromise MySQL Server bsc1217405...

The vulnerability of the web server of the microprogramming software for communication modules of SIMATIC CP, SIPLUS NET CP 1543-1, and the servo drive system SINAMICS S210 allows a intruder to cause service interruptions.

The vulnerability of the web server of the microprogramming software for communication modules of SIMATIC CP, SIPLUS NET CP 1543-1, and the servo drive system SINAMICS S210 is related to the lack of a mechanism for releasing memory. Exploiting this vulnerability could allow an attacker, operating...

The vulnerability of the DHCP server service for Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the DHCP server service for Windows operating systems is related to insufficient protection of service-related data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Request Smuggling org.apache.tomcat:tomcat-catalina Dependency in Bamboo Data Center and Server

This High severity org.apache.tomcat:tomcat-catalina Dependency vulnerability was introduced in versions 9.2.1, 9.3.0, and 9.4.0 of Bamboo Data Center and Server. This org.apache.tomcat:tomcat-catalina Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

The vulnerability of the sub_4119A0 function in the microprogramming software of the TOTOLINK X6000R router allows a hacker to execute arbitrary code.

The vulnerability of the sub4119A0 function shttpd in the TOTOLINK X6000R router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Out of memory error when submitting the dataset form with a specially-crafted field

Impact When submitting a POST request to the /dataset/new endpoint including either the auth cookie or the Authorization header with a specially-crafted field, an attacker can create an out-of-memory error in the hosting server. To trigger this error the user needs to have permissions to create o...

CVE-2023-36012

DHCP Server Service Information Disclosure Vulnerability...

CVE-2023-35638

DHCP Server Service Denial of Service Vulnerability...

CVE-2022-47374

A vulnerability has been identified in SIMATIC PC-Station Plus All versions, SIMATIC S7-400 CPU 412-2 PN V7 All versions, SIMATIC S7-400 CPU 414-3 PN/DP V7 All versions, SIMATIC S7-400 CPU 414F-3 PN/DP V7 All versions, SIMATIC S7-400 CPU 416-3 PN/DP V7 All versions, SIMATIC S7-400 CPU 416F-3 PN/D...

PT-2023-8962

Name of the Vulnerable Software and Affected Versions xorg-server affected versions not specified Description A flaw was found in xorg-server, where a specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow, potentially leading to the...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2023-3258)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Siemens SIMATIC CP 1242-7 安全漏洞

SIMATIC CP 1242 and CP 1243 correlation processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as firewalls, virtual private networks VPNs, and support for other data encryption protocols.SIMATIC CP 1543-1 communication processors...

haproxy: Proxy forwards malformed empty Content-Length headers

A flaw was found in HAProxy. Empty Content-Length headers are forwarded, which could cause an HTTP/1 server behind it to interpret the payload as an extra request. This may render the HTTP/1 server vulnerable to attacks in some uncommon cases...

CVE-2023-49293

A cross-site scripting XSS vulnerability was found in vitejs that can be triggered by sending a malicious payload through server.transformIndexHtml. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria...

jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies

A flaw was found in the jetty-server package. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies or otherwise perform unintended behavior by tampering with the cookie parsing mechanism...

The vulnerability of the Private Key Handler component in the server that unlocks encrypted disks of Tang allows a hacker to disclose the protected information.

The vulnerability of the Private Key Handler component in the server that unlocks encrypted disks of the Tang service is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

The vulnerability of the uC-HTTP server, related to writing beyond the buffer boundary, allows attackers to execute arbitrary code.

The vulnerability of the uC-HTTP server is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted HTTP request...

IBM InfoSphere Information Server 跨站脚本漏洞

IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server, which can be...

Use-After-Free

xorg-server is vulnerable to Use-After-Free. The vulnerability is triggered by warping the pointer between screens during shutdown or reset which could allow attackers to escalate privileges or crash the server...

CVE-2023-48811

In TOTOLINK X6000R V9.4.0cu.852B20230719, the shttpd file, sub4119A0 function obtains fields from the front-end through Uci Set The Str function that when passed to the CsteSystem function creates a command execution vulnerability...