Security Bulletin: IBM Cloud Pak for Data is vulnerable to expose sensitive information due to RubyGems activesupport ( CVE-2023-38037 )

Summary RubyGems activesupport is used by IBM Cloud Pak for Data as part of the platform. CVE-2023-38037. Vulnerability Details CVEID:CVE-2023-38037 DESCRIPTION: RubyGems activesupport gemcould allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the...

OESA-2024-2192 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

PT-2024-9621 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A vulnerability has been discovered in the qtdemux merge sample table function within qtdemux.c, which is part of the GStreamer library. This issue is related to an out-of-bounds OOB read in...

PT-2024-28891 · Openpetra · Openpetra

Name of the Vulnerable Software and Affected Versions: openPetra version 2023.02 Description: A Cross Site Scripting vulnerability in openPetra allows a remote attacker to obtain sensitive information via the serverMReporting.asmx function. Recommendations: For openPetra version 2023.02, consider...

PT-2024-32419 · Gotenna · Gotenna Pro App

Name of the Vulnerable Software and Affected Versions: goTenna Pro App versions prior to the current app version Description: The issue concerns the lack of encryption for callsigns in messages. This could potentially reveal sensitive information about users and may be leveraged for other...

PT-2024-31959 · Vonets · Vap11G-300

Name of the Vulnerable Software and Affected Versions: VONETS VAP11G-300 version 3.3.23.6.9 Description: A command injection issue was discovered via the SystemCommand object. This allows for the execution of arbitrary commands. Recommendations: For version 3.3.23.6.9, consider disabling the...

Security Bulletin: Vulnerability in Google Guava affects IBM watsonx.data

Summary Google Guava could allow a local authenticated attacker to obtain sensitive information, caused by a flaw with using Java's default temporary directory for file creation in FileBackedOutputStream. By sending a specially crafted request, an attacker could exploit this vulnerability to acce...

Security Bulletin: Vulnerability in Google Guava affects IBM watsonx.data

Summary Google Guava could allow a local authenticated attacker to obtain sensitive information, caused by a flaw with using Java's default temporary directory for file creation in FileBackedOutputStream. By sending a specially crafted request, an attacker could exploit this vulnerability to acce...

Apache Hadoop: Temporary File Local Information Disclosure

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

GHSA-F5FW-25GW-5M92 Apache Hadoop: Temporary File Local Information Disclosure

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

CVE-2024-23454

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

CVE-2024-23454 Apache Hadoop: Temporary File Local Information Disclosure

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

CVE-2024-23454 Apache Hadoop: Temporary File Local Information Disclosure

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

CVE-2024-23454 Apache Hadoop: Temporary File Local Information Disclosure

Apache Hadoop’s RunJar.run does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local user...

CVE-2024-23454

CVE-2024-23454 pertains to Apache Hadoop where RunJar.run() may create temporary files without explicitly setting POSIX permissions. The issue arises because on Unix-like systems the system temp directory is shared among local users, so if the program writes data without proper permissions, other...

PT-2024-40922 · Atty +1 · Atty +1

Name of the Vulnerable Software and Affected Versions: atty affected versions not specified Description: The maintainer of atty has announced that the crate is no longer under development. Users are recommended to rely on the functionality in the standard library's IsTerminal trait instead...

Rocket.Chat 安全漏洞

Rocket.Chat is a chat program from Rocket.Chat Inc. A security vulnerability exists in Rocket.Chat. An attacker exploiting this vulnerability can abuse the UpdateOTRAck method to send temporary messages. The following versions are affected: version 6.12.0, version 6.11.2, version 6.10.5, version...

PT-2024-7142 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.4R3-S7 Junos OS versions 22.2 prior to 22.2R3-S4 Junos OS versions 22.3 prior to 22.3R3-S3 Junos OS versions 22.4 prior to 22.4R3-S2 Junos OS versions 23.2 prior to 23.2R2-S1 Junos OS versions 23.4 prior to...

Apache Hadoop 安全漏洞

Apache Hadoop is a set of open source distributed systems infrastructure from the American Apache Apache Foundation. It is capable of distributed processing of large amounts of data and is characterized by high reliability, high scalability, and high fault tolerance. Apache Hadoop has a security...

PT-2024-10158

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A stack-buffer overflow has been detected in the vorbis handle identification packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd-vi.channels...