CLSA-2023-1688674204 java-1.8.0-openjdk: Fix of 7 CVEs

Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u372-b07. That fixes following CVEs: - CVE-2023-21930: Improper connection handling during TLS handshake 8294474 - CVE-2023-21937: Missing string checks for NULL characters 8296622 - CVE-2023-21938: Incorrect handling of NULL characters in...

Security Bulletin: Watson CP4D Data Stores is vulnerable to unspecified vulnerability Golang Go (CCVE-2022-23773)

Summary Potential Golang Go unspecified vulnerability CVE-2022-237732 has been identified that may affect Watson CP4D Data Stores Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-23773 DESCRIPTION: An unspecified error with not treating branches with...

PT-2023-25849 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: Distributed file system affected versions not specified Description: The issue is related to missing input length verification in the distributed file system. This could potentially lead to an out-of-bounds read if successfully exploited...

Improper Neutralization of Special Elements used in a Command ('Command Injection')

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6...

Advisory ROSA-SA-2023-2178

software: leptonica 1.79.0 WASP: ROSA-CHROME packageevrstring: leptonica-1.79.0-3.src.rpm CVE-ID: CVE-2022-38266 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: An issue in the linked Leptonica library v1.79.0 allows attackers to raise an arithmetic exception leading to a denial of service DoS via a...

Huawei EulerOS: Security Advisory for haproxy (EulerOS-SA-2023-2269)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-36217 · Hashicorp · Terraform

Name of the Vulnerable Software and Affected Versions: Terraform affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the Go 1.20 security release. Recommendations: At the moment, there is no information about a newer...

PT-2023-36214 · Unknown · Prometheus-Sap Host Exporter

Name of the Vulnerable Software and Affected Versions: prometheus-sap host exporter affected versions not specified Description: The issue concerns a security update for prometheus-sap host exporter, which includes a rebuild of the package with the go 1.20 security release. Additionally, the...

CVE-2023-22815 Post-authentication remote command injection vulnerability on Western Digital My Cloud OS 5 devices

Post-authentication remote command injection vulnerability in Western Digital My Cloud OS 5 devices that could allow an attacker to execute code in the context of the root user on vulnerable CGI files. This vulnerability can only be exploited over the network and the attacker must already have...

CVE-2023-36807

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In version 2.10.5 an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This infinite loop blocks the current process and can utilize a single co...

Security update for keepass (important)

openSUSE Security Update: Security update for keepass Announcement ID: openSUSE-SU-2023:0163-1 Rating: important References: 1211397 Cross-References: CVE-2023-32784 CVSS scores: CVE-2023-32784 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Backports SLE-15-SP5...

Low: Red Hat Security Advisory: open-vm-tools security update

An update for open-vm-tools is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Security update for libjxl (moderate)

openSUSE Security Update: Security update for libjxl Announcement ID: openSUSE-SU-2023:0161-1 Rating: moderate References: 1212492 Cross-References: CVE-2023-35790 CVSS scores: CVE-2023-35790 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP5 A...

PT-2023-36315 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue concerns a spurious warning introduced in the IPv6 subsystem of the Linux kernel after updates USN-6081-1, USN-6084-1, USN-6092-1, and USN-6095-1, which were intended to fix...

Security update for gifsicle (important)

openSUSE Security Update: Security update for gifsicle Announcement ID: openSUSE-SU-2023:0160-1 Rating: important References: 1212645 Cross-References: CVE-2023-36193 CVSS scores: CVE-2023-36193 SUSE: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Backports SLE-15-SP...

PT-2023-17944 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a heap buffer overflow in the Google BMS kernel module, which could lead to a local escalation of privilege. System execution privileges are needed for exploitation, and user interaction is...

CVE-2023-34240 Weak passwords allowed in cloudexplorer-lite

Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong...

CVE-2023-34240 Weak passwords allowed in cloudexplorer-lite

Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong...

PT-2023-36201 · Go +1 · Go +1

Name of the Vulnerable Software and Affected Versions: kubernetes version 1.24 Description: The issue is related to a security release in the go 1.20 package, which is used by kubernetes. The package has been rebuilt with the go 1.20 security release to address the issue. Recommendations: For...

MagnusBilling application unauthenticated Remote Command Execution.

A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. A piece of demonstration code is present in lib/icepay/icepay.php, with a call to an exec. The parameter to exec includes the GET paramete...