SUSE-SU-2023:3531-1 Security update for buildah

This update of buildah fixes the following issues: - rebuild the package with the go 1.21 security release bsc1212475...

The vulnerability of the web interface of the Cisco Intersight Virtual Appliance, a software tool for managing cloud systems, allows a perpetrator to execute arbitrary commands.

The vulnerability of the web interface for managing Cisco Intersight Virtual Appliance software lies in insufficient validation of input data during the extraction of loaded software packages. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Input validation

Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the affected device to exploit these vulnerabilities. These...

CVE-2023-20013

CVE-2023-20013 relates to multiple command-injection vulnerabilities in Cisco Intersight Private Virtual Appliance. The underlying issue is insufficient input validation when extracting uploaded software packages, which allows an authenticated attacker with Administrator privileges to upload a cr...

CVE-2023-20013: Improper Neutralization of Special Elements used in an OS Command

Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary commands using root-level privileges. The attacker would need to have Administrator privileges on the affected device to exploit these vulnerabilities. These...

MAL-2023-1260 Malicious code in orbit-themer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e59310eaedaf4f0aea5f0369808690dc45cb900d5acc5f22ba9503d8b1515421 The OpenSSF Package Analysis project identified 'orbit-themer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

GLPI vulnerable to unauthorized access to KnowbaseItem data

[email protected] reports: GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version...

SUSE-SU-2023:2665-1 Security update for cosign

This update of cosign fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

CVE-2023-2878 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver, vault-csi-provider...

CVE-2023-33959 vulnerabilities

Vulnerabilities for packages: zot...

CVE-2023-31124 vulnerabilities

Vulnerabilities for packages: c-ares...

Malicious code in marathi_chawat_katha_mck_comics_by_24_gw97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8f2db052000fc6063f23b25b1e074b2c97af8149bd18b477e91746e4b2b803a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-28639

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is...

CVE-2023-28639

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is...

CVE-2023-28636

GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7...

CVE-2023-28849

CVE-2023-28849 affects GLPI prior to 10.0.7 where the inventory endpoint allows unauthenticated access enabling SQL injection and potential XSS; GLPI 10.0.7 patches the issue, with a workaround to disable native inventory. Additional connected PT Security entries describe related SQLi and SSRF/XS...

CVE-2023-28636

GLPI vulnerability CVE-2023-28636 affects GLPI versions before 9.5.13 and 10.0.7 (starting from version 0.60). An administrator can create a malicious external link due to the flaw, with fixes implemented in 9.5.13 and 10.0.7. Exploitation details are not described in the provided documents beyon...

CVE-2023-0056 vulnerabilities

Vulnerabilities for packages: haproxy...

SUSE-SU-2023:0867-1 Security update for oracleasm

This update of oracleasm fixes the following issues: - rebuild the package with the new secure boot key bsc1209188...

GHSA-6722-XVQ8-3254 SketchSVG Arbitrary Code Injection vulnerability

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrization while concatenating the current directory as part of the command string...