Huawei EulerOS: Security Advisory for apr-util (EulerOS-SA-2023-1835)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Low: Red Hat Security Advisory: libarchive security update

An update for libarchive is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

ntfs-3g: heap-based buffer overflow in ntfsck

A vulnerability was found in NTFS-3G, specifically in the ntfsck utility. Incorrect validation of NTFS metadata can result in a heap-based buffer overflow when processing a crafted NTFS image file or partition...

PT-2023-12095 · Smu · Smu

Name of the Vulnerable Software and Affected Versions: SMU affected versions not specified Description: The issue is related to insufficient input validation of mailbox data in the SMU, which may allow an attacker to coerce the SMU to corrupt SMRAM. This could potentially lead to a loss of...

ALSA-2023:2532 Low: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

Low: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: Incorrect handling of control code characters in cookies CVE-2022-35252 curl: Use-after-free triggered by an HTTP pro...

CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine

An ongoing phishing campaign with invoice-themed lures is being used to distribute the SmokeLoader malware in the form of a polyglot file, according to the Computer Emergency Response Team of Ukraine CERT-UA. The emails, per the agency, are sent using compromised accounts and come with a ZIP...

[SECURITY] Fedora 38 Update: rust-sevctl-0.3.2-4.fc38

Administrative utility for AMD SEV...

EulerOS Virtualization 3.0.2.0 : xz (EulerOS-SA-2023-1739)

According to the versions of the xz packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name...

codehaus-plexus: XML External Entity (XXE) Injection

A flaw was found in codehaus-plexus. The org.codehaus.plexus.util.xml.XmlWriterUtilwriteComment fails to sanitize comments for a -- sequence. This issue means that text contained in the command string could be interpreted as XML and allow for XML injection...

Oracle Solaris Utility Error

The vulnerability of the Oracle Solaris operating system’s Utility component is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Oracle Solaris Utility Arbitrary Action

The vulnerability of the Utility component in Oracle Solaris is related to insufficient validation of input data. Exploiting this vulnerability may allow an attacker to perform arbitrary actions...

CVE-2023-27378

Multiple reflected cross-site scripting XSS vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2023-28406 BIG-IP Configuration utility vulnerability

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. Note:...

CVE-2023-28406

The CVE-2023-28406 issue affects F5 BIG-IP, specifically the BIG-IP Configuration utility. Root cause: a path traversal vulnerability in an undisclosed page of the Configuration utility allowing an authenticated user to read XML files. Impact is limited to control plane access with no data plane ...

CVE-2023-27378 BIG-IP TMUI XSS vulnerability

Multiple reflected cross-site scripting XSS vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2023-27378

CVE-2023-27378 affects BIG-IP Configuration utility with multiple reflected XSS in undisclosed pages. Affected versions include BIG-IP (all modules): 17.0.0–17.1.0, 16.1.0–16.1.3, 15.1.0–15.1.8, 14.1.0–14.1.5, and 13.x. Fixes introduced in 17.1.0.1 (for 17.x), 16.1.3.4 (for 16.x), 15.1.8.2 (for 1...

CVE-2023-27378: Improper Neutralization of Input During Web Page Generation

Multiple reflected cross-site scripting XSS vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not...

CVE-2023-28406: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control what information is obtained. Note:...