@story-telling-reporter/draft-editor (>=2.1.0-beta.0, <=2.1.2) potentially affected by unknown CVE via @keystone-6/core (5.2.0)

@keystone-6/core NPM version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @story-telling-reporter/draft-editor =2.1.0-beta.0, =2.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-5FP6-4XW3-XQQ3...

@akrc/vidocs (>=0.0.0, <=0.0.2), @alexzzz/npms (>=0.0.5, <=0.2.0) +114 more potentially affected by CVE-2023-34092 via vite (>=3.0.2, <=3.2.5)

vite NPM version =3.0.2, =0.0.0, =0.0.5, =1.0.1, =1.0.1, =3.2.0, =0.0.37, =0.0.35, =0.2.3, =0.0.0-canary-20220914153453, =0.0.6, =0.1.0, =0.0.3, =6.24.0, =0.1.1, =0.1.23 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@aem-vite/import-rewriter (>=5.0.1, <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0-alpha.1, <=2.3.1) +210 more potentially affected by CVE-2023-34092 via vite (>=2.0.0-beta.4, <=2.9.15)

vite NPM version =2.0.0-beta.4, =5.0.1, =1.0.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.2, =0.9.1, =1.0.16, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.16 and more Source cves: CVE-2023-34092 Source advisory...

JVN#38222042: DataSpider Servista uses a hard-coded cryptographic key

DataSpider Servista provided by SAISON INFORMATION SYSTEMS CO.,LTD. is a data integration software. ScriptRunner and ScriptRunner for Amazon SQS are used to start the configured processes on DataSpider Servista. The cryptographic key is embedded in ScriptRunner and ScriptRunner for Amazon SQS,...

USN-6005-2 sudo vulnerabilities

USN-6005-1 fixed vulnerabilities in Sudo. This update provides the corresponding updates for Ubuntu 16.04 LTS. Original advisory details: Matthieu Barjole and Victor Cutillas discovered that Sudo incorrectly escaped control characters in log messages and sudoreplay output. An attacker could...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Nova regression (USN-6073-8)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6073-8 advisory. USN-6073-3 fixed a vulnerability in Nova. Unfortunately the update introduced a regression with detaching volumes. The security fix has been...

SUSE SLES15 / openSUSE 15 Security Update : terraform-provider-aws (SUSE-SU-2023:2253-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2253-1 advisory. - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658. Tenable has extracted the preceding description...

CVE-2023-20163

Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid credentials on an affected...

@chargeover/strapi (0.0.1-rc1.1), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3) +7 more potentially affected by CVE-2023-22621 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.5.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =1.0.2 - easylaser-vn-cms 0.1.0 - strapi-ent-a 0.1.0 - strapi-fcm 0.1.0 - strapi-voting 0.2.1 - sveltekit-strapi 0.1.0 Source cves: CVE-2023-22621 Source advisory: OSV:GHSA-2H87-4Q2W-V4HF...

Mozilla: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10

The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers Andrew Osmond, Sebastian Hengst, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and...

CVE-2023-23998

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in E4J s.R.L. VikRentCar Car Rental Management System plugin = 1.3.0 versions...

aesti (>=0.1.0, <=0.3.0), atarashii_imap (0.3.0) +382 more potentially affected by unknown CVE via openssl (>=0.9.24, <=0.10.40)

openssl CARGO version =0.9.24, =0.1.0, =0.1.0, =0.0.0, =0.2.0, =0.15.0, =0.3.1, =0.0.1, =0.3.2, =0.1.1, =0.1.4, =0.1.0, =0.1.3, =0.1.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9QWG-CRG9-M2VC...

amts-prelude (>=0.2.2, <=0.2.4), async-nats (>=0.9.0, <=0.10.1) +36 more potentially affected by unknown CVE via nats (>=0.9.18, <=0.23.1)

nats CARGO version =0.9.18, =0.2.2, =0.9.0, =0.6.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.17.0, =0.1.0, =0.1.0, =0.1.0, =0.7.0, =0.0.1, =0.1.0, =0.6.0-beta.1, =0.9.4 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0029...

@web-desktop-environment/development-edition-server (>=2.0.0-2, <=2.0.0-alpha.11), @web-desktop-environment/pack-dev (>=2.0.0-1, <=2.0.0-alpha.11) potentially affected by CVE-2023-26114 via code-server (>=4.4.0, <=4.5.1)

code-server NPM version =4.4.0, =2.0.0-2, =2.0.0-1, =2.0.0-alpha.11 Source cves: CVE-2023-26114 Source advisory: OSV:GHSA-FRJG-G767-7363...

RHEL 9 : gnutls (RHSA-2023:1200)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1200 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS...

Fedora: Security Advisory for libmemcached-awesome (FEDORA-2023-fd848970c4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

dbaas (>=0.1.6, <=0.7.1) potentially affected by CVE-2023-27474 via directus (>=9.6.0, <=9.21.2)

directus NPM version =9.6.0, =0.1.6, =0.7.1 Source cves: CVE-2023-27474 Source advisory: OSV:GHSA-4HMQ-GGRM-QFC6...

cacheline-ef (>=1.0.0, <=1.1.0), dsi-bitstream (0.4.2) +8 more potentially affected by unknown CVE via maligned (0.2.1)

maligned CARGO version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on maligned and may be impacted: - cacheline-ef =1.0.0, =0.4.0, =0.6.0, =0.1.6, =0.1.0, =0.1.0, =0.4.0, =0.4.2 - vframe 0.3.2 Source cves: unknown CVE Source advisory:...

Osprey Pump Controller 1.0.1 pseudonym Command Injection Vulnerability

Osprey Pump Controller version 1.0.1 suffers from an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through the pseudonym HTTP POST parameter called by index.php script. Osprey Pump Controller 1.0.1 pseudonym Semi-blind...

AZL-13649 CVE-2023-23915 affecting package cmake for versions less than 3.21.4-5

A cleartext transmission of sensitive information vulnerability exists in curl v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP...