macOS 13.x < 13.4 Multiple Vulnerabilities (HT213758)

The remote host is running a version of macOS / Mac OS X that is 13.x prior to 13.4. It is, therefore, affected by multiple vulnerabilities: - In Sudo before 1.9.12p2, the sudoedit aka -e feature mishandles extra arguments passed in the user- provided environment variables SUDOEDITOR, VISUAL, and...

macOS 12.x < 12.6.6 Multiple Vulnerabilities (HT213759)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6.6. It is, therefore, affected by multiple vulnerabilities: - A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, macOS Ventura 13.4, iOS 15.7.6 a...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers versions prior to 4.30.0, which stems from the presence of an insecure temporary file in the program...

PT-2023-5816 · Apple · Macos Ventura +5

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.4 tvOS versions prior to 16.5 iOS versions prior to 16.5 iPadOS versions prior to 16.5 watchOS versions prior to 9.5 Description: A privacy issue was addressed with improved handling of temporary files. This...

PT-2023-23439 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 Description: The issue concerns a Command Injection vulnerability. It can be exploited via the "/cgi-bin/cstecgi.cgi" API endpoint. Recommendations: For TOTOLINK A3300R version 17.0.0cu.557, as a temporary...

CVE-2023-2800

CVE-2023-2800 affects Hugging Face Transformers (prior to 4.30.0). Insecure temporary file creation via tempfile.mktemp() could enable local denial of service. The IBM/IBM Cloud Pak bulletin and GH advisories confirm the workaround: upgrade Transformers to 4.30.0 or newer.

PT-2023-20367 · Hermes +1 · Hermes +2

Name of the Vulnerable Software and Affected Versions: TypedArray versions prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 Description: A type confusion bug in TypedArray could have been used by a malicious attacker to execute arbitrary code via untrusted JavaScript. This is only...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

PT-2023-21290 · Weaver Oa · Weaver Oa

Name of the Vulnerable Software and Affected Versions: Weaver OA version 9.5 Description: A vulnerability was found in the processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2 config.ini, which can lead to files or directories being made accessible. The attack may be initiate...

PT-2023-22437 · Exelysis · Exelysis Unified Communication Solution

Name of the Vulnerable Software and Affected Versions: Exelysis Unified Communication Solution EUCS version 1.0 Description: A Cross Site Scripting issue allows a remote attacker to gain privileges via the URL path of the eucsAdmin login web page. Recommendations: For Exelysis Unified Communicati...

PT-2023-23435 · Yasm +1 · Yasm +1

Name of the Vulnerable Software and Affected Versions: yasm version 1.3.0.55.g101bc Description: A segmentation violation was discovered in yasm via the function expand mmac params at /nasm/nasm-pp.c. Recommendations: For yasm version 1.3.0.55.g101bc, as a temporary workaround, consider disabling...

PT-2023-23436 · Yasm +1 · Yasm +1

Name of the Vulnerable Software and Affected Versions: yasm version 1.3.0.55.g101bc Description: A segmentation violation was discovered in yasm via the function do directive at /nasm/nasm-pp.c. Recommendations: For yasm version 1.3.0.55.g101bc, consider restricting access to the do directive...

postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions

A flaw was found in org.postgresql. This issue allows the creation of a temporary file when using PreparedStatement.setTextint, InputStream and PreparedStatemet.setByteaint, InputStream. This could allow a user to create an unexpected file available to all users, which could end in unexpected...

Moderate: Red Hat Security Advisory: postgresql-jdbc security update

An update for postgresql-jdbc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CentOS 8 : postgresql-jdbc (CESA-2023:2867)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:2867 advisory. - pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or...

Moderate: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fixes: postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file...

ALSA-2023:2867 Moderate: postgresql-jdbc security update

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fixes: postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file...

Oracle Linux 9 : postgresql-jdbc (ELSA-2023-2378)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-2378 advisory. 42.2.27-1 - rebase to 42.2.27 - fix for CVE-2022-41946 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

Siemens SCALANCE LPE9403 Creation of Temporary File with Insecure Permissions (CVE-2023-27408)

A vulnerability has been identified in SCALANCE LPE9403 All versions V2.1. The i2c mutex file is created with the permissions bits of -rw-rw-rw-. This file is used as a mutex for multiple applications interacting with i2c. This could allow an authenticated attacker with access to the SSH interfac...

AlmaLinux 9 : postgresql-jdbc (ALSA-2023:2378)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:2378 advisory. - pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either PreparedStatement.setTextint, InputStream or...