go-toolset:rhel8 security and bug fix update

An update is available for delve, golang, go-toolset. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset provides the Go programming language tools and...

Moderate: go-toolset:rhel8 security and bug fix update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: archive/tar: unbounded memory consumption when reading headers CVE-2022-2879 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters...

RHEL 7 : go-toolset-1.18 (RHSA-2023:0445)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0445 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: archive/ta...

Moderate: Red Hat Security Advisory: go-toolset and golang security and bug fix update

An update for go-toolset and golang is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

WordPress Crayon Syntax Highlighter Plugin <= 2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Crayon Syntax Highlighter Type Plugin Vulnerable versions = 2.8.4 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47167 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 6128d1f41a07 Credits István Márt...

XSS via markdown syntax

Description Hi,Maintainer,thanks for reading.I am glad to report a secure problem to you. I found that your forum allows users to use markdown syntax to post articles and comments, but there is no corresponding protection means, which is unsafe. Any user can post dangerous content, like the...

WS-2023-0033

XSS via markdown syntax in leobbs/leobbs...

PT-2023-14818 · Discourse · Discourse-Mermaid-Theme-Component +1

Name of the Vulnerable Software and Affected Versions: Discourse Mermaid discourse-mermaid-theme-component version 1.0.0 Description: The issue allows users who can create posts to inject arbitrary HTML on that post, using the Mermaid syntax in Discourse, open-source forum software...

LibKSBA Numerical Overflow Code Execution

The vulnerability of the library’s certificate handling function for X.509 certificates is related to a numerical overflow in the CRL syntax analyzer. Exploiting this vulnerability allows an attacker to send specially crafted data to the application, trigger a numerical overflow, and execute...

ALPINE-CVE-2022-44640

Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center KDC...

OESA-2022-2153 samba security update

Security Fixes: Invalid free in ASN.1 codec...

CVE-2022-44031: Improper Neutralization of Input During Web Page Generation

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...

Redmine cross-site scripting vulnerabilities

Redmine is a set of open source Web-based project management and defect tracking tools . The product provides features such as project management, issue tracking and role-based access control. A cross-site scripting vulnerability exists in Redmine versions prior to 4.2.9 and 5.0.x through 5.0.4,...

CVE-2022-44031

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...

CVE-2022-44031

Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...

Researchers Detail New Attack Method to Bypass Popular Web Application Firewalls

A new attack method can be used to circumvent web application firewalls WAFs of various vendors and infiltrate systems, potentially enabling attackers to gain access to sensitive business and customer information. Web application firewalls are a key line of defense to help filter, monitor, and...

OPENSUSE-SU-2022:10230-1 Security update for cherrytree

cherrytree was updated to version 0.99.49+3: Legacycanonicalizefilename: manage empty filename, ghgiuspen/cherrytree2118 added command line option '--anchor AnchorName' that in addition to existing '--node NodeName' allows to open a document focusing an anchor in a node. Changed non configurable...

A Syntax Error Led to Crashing of KmsdBot Cryptomining Botnet

By Deeba Ahmed The KmsdBot was known for targeting both Linux and Windows devices. This is a post from HackRead.com Read the original post: A Syntax Error Led to Crashing of KmsdBot Cryptomining Botnet...

Cisco Firepower Management Center Software XXE Injection (cisco-sa-fmc-xxe-MzPC4bYd)

The version of Cisco Firepower Management Center installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center FMC Software due to insufficient validation of...

Heimdal security vulnerabilities

Heimdal is Heimdal open source a Kerberos implementation and security program . Heimdal KDC has a security vulnerability , the vulnerability stems from the ASN.1 codec in the invalid free , an attacker can use the vulnerability can use Kerberos authentication can simulate a client or service to...