Rocky Linux 8 : tcpdump (RLSA-2021:4236)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4236 advisory. - The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. CVE-2020-8037 Note that Nessus has not tested for this issue but h...

Low: elfutils

Issue Overview: In elfutils 0.183, an infinite loop was found in the function handlesymtab in readelf.c .Which allows attackers to cause a denial of service infinite loop via crafted file. CVE-2021-33294 Affected Packages: elfutils Note: This advisory is applicable to Amazon Linux 2 AL2 Core...

Security Bulletin: GNOME libxml2 vulnerability affects IBM Safer Payments (CVE-2023-29469)

Summary Libxml2 is used by IBM Safer Payments as part of PMML models, external queries, and docx file templates for Outgoing Channel Configurations. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-29469 DESCRIPTION: GNOME libxml2 is vulnerable to a denial of service,...

Security Bulletin: IBM WebSphere Application Server could provide weaker than expected security (CVE-2023-35890)

Summary IBM WebSphere Application Server could provide weaker than expected security. This has been addressed in the Remediation/Fixes section. Vulnerability Details CVEID:CVE-2023-35890 DESCRIPTION: IBM WebSphere Application Server could provide weaker than expected security, caused by the...

ReDoS vulnerability in URI

We have released the uri gem version 0.12.2, 0.10.3 that has a security fix for a ReDoS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2023-36617. Details A ReDoS issue was discovered in the URI component through 0.12.1 for Ruby. The URI parser mishandles invalid URLs...

USN-6143-2: Firefox regressions

USN-6143-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted...

PT-2023-24508 · Cloudogu Gmbh · Scm Manager

Name of the Vulnerable Software and Affected Versions: Cloudogu GmbH SCM Manager versions 1.2 through 1.60 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field. This enables...

PT-2023-24020 · Unknown · Opc Ua Legacy Java Stack

Name of the Vulnerable Software and Affected Versions: OPC UA Legacy Java Stack versions prior to 6f176f2 Description: The issue allows an attacker to block OPC UA server applications via uncontrolled resource consumption, causing them to be unable to serve client applications. This is a...

RHEL 9 : libtpms (RHSA-2023:2453)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:2453 advisory. The libtpms is a library providing Trusted Platform Module TPM functionality for virtual machines. Security Fixes: tpm: TCG TPM2.0...

Mageia: Security Advisory (MGASA-2023-0158)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-3564 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions =5.4 Description: The issue is related to incorrect verifier pruning in BPF in the Linux Kernel, which leads to unsafe code paths being incorrectly marked as safe. This results in arbitrary read/write in kernel memory,...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.524.5.el7 - rds/ib: Fix the softlock-up in RDS cache GC worker Arumugam Kolappan Orabug: 35079728 4.14.35-2047.524.4.el7 - xfs: add missing cmap-brstate = XFSEXTNORM update Gao Xiang Orabug: 35202792 - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms Feng Tang...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2023-20584 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server version 9.0 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Debian: Security Advisory (DLA-1424-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Vulnerability (CVE-2022-3676) in Eclipse Openj9 affects CICS Transaction Gateway Desktop Edition

Summary Eclipse Openj9 is used by CICS Transaction Gateway Desktop Edition. The fix removes vulnerability CVE-2022-3676 that could allow a remote attacker to bypass security restrictions. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass...

OpenBSD OpenSSH 9.1 Memory Safety Vulnerability

OpenBSD OpenSSH is prone to a memory safety vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...

PT-2023-19375 · Lightftp · Lightftp

Name of the Vulnerable Software and Affected Versions: LightFTP versions 1.0 through 2.2 LightFTP version 2.2 Description: A race condition in the software allows an attacker to achieve path traversal via a malformed FTP request. This occurs because a handler thread can use an overwritten...

ruby:2.5 security update

ruby 2.5.9-110.0.1 - Fix for CVE-2022-28739 Orabug: 34824177...

Security Bulletin: IBM Robotic Process Automation for Cloud Pak is vulnerable to privilege escalation.

Summary IBM Robotic Process Automation for Cloud Pak could allow a local user to perform unauthorized actions due to insufficient permission settings. Vulnerability Details CVEID:CVE-2023-22592 DESCRIPTION: IBM Robotic Process Automation for Cloud Pak could allow a local user to perform...