Security Bulletin: CWE – 307: Inadequate Account Lockout may affect IBM CICS TX Advanced.

Summary CWE - 307 may affect IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable CWE. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Product| Versions ---|--- IBM CICS TX Advanced| 10.1 IBM...

PT-2023-21476 · Hcl · Hcl Workload Automation

Name of the Vulnerable Software and Affected Versions: HCL Workload Automation affected versions not specified Description: HCL Workload Automation is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this issue to expose sensitive...

CVE-2023-30623 Arbitrary command injection in embano1/wip

embano1/wip is a GitHub Action written in Bash. Prior to version 2, the embano1/wip action uses the github.event.pullrequest.title parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This...

CVE-2023-24822

CVE-2023-24822 affects RIOT-OS: the network stack processing 6LoWPAN frames is vulnerable to a NULL-pointer dereference when encoding the 6LoWPAN IPHC header, prior to version 2022.10. Exploitation results in a hard fault and denial of service. The issue is fixed in version 2022.10; a manual patc...

CVE-2023-24818 RIOT-OS vulnerable to null pointer dereference during fragment forwarding

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to process 6LoWPAN frames. Prior to version 2022.10, an attacker can send a crafted frame to the device resulting in a NULL pointer dereference. During forwarding of a fragment an...

Security Bulletin: IBM Safer Payment affected by OpenSSL Racoon Attack (CVE-2020-1968)

Summary IBM Safer Payments uses OpenSSL. This vulnerability is addressed. Vulnerability Details CVEID:CVE-2020-1968 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a Raccoon attack in the TLS specification. By computing the pre-master secret in...

SUSE-SU-2023:1958-1 Security update for ovmf

This update for ovmf fixes the following issues: - CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 bsc1174246. - CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd bsc1196741...

PT-2023-36145 · Indent · Indent

Name of the Vulnerable Software and Affected Versions: indent affected versions not specified Description: The issue concerns multiple memory safety issues. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

SUSE-SU-2023:1940-1 Security update for ovmf

This update for ovmf fixes the following issues: - CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 bsc1174246. - CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd bsc1196741...

SUSE-SU-2023:1921-1 Security update for ovmf

This update for ovmf fixes the following issues: - CVE-2019-14560: Fixed potential secure boot bypass via an improper check of GetEfiGlobalVariable2 bsc1174246. - CVE-2021-38578: Fixed underflow in MdeModulePkg/PiSmmCore SmmEntryPointAdd bsc1196741...

SUSE-SU-2023:1909-1 Security update for libgit2

This update for libgit2 fixes the following issues: - CVE-2023-22742: Fixed SSH keys verification failure bsc1207364...

CVE-2023-30608

CVE-2023-30608 affects the Python package sqlparse (non-validating SQL parser module). A vulnerable regular expression in the parser can cause Regular Expression Denial of Service (ReDoS) leading to DoS conditions. The issue was introduced by commit e75e358 and is fixed in sqlparse 0.4.4 via comm...

PT-2023-2629 · Oracle · Oracle Financial Services Behavior Detection Platform

Name of the Vulnerable Software and Affected Versions: Oracle Financial Services Behavior Detection Platform version 8.0.8.1 Description: The issue is related to insufficient input validation in a subcomponent of the Oracle Financial Services Behavior Detection Platform, which is part of the Orac...

SUSE-SU-2023:1872-1 Security update for nodejs14

This update for nodejs14 fixes the following issues: - CVE-2022-25881: Fixed regular expression denial of service vulnerability bsc1208744...

CLSA-2023-1681744375 nss: Fix of CVE-2023-0767

CVE-2023-0767: nss: improve handling of unknown PKCS12 safe bag types...

SUSE-SU-2023:1871-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - CVE-2022-25881: Fixed regular expression denial of service vulnerability bsc1208744...

SUSE-SU-2023:1867-1 Security update for gradle

This update for gradle fixes the following issues: - CVE-2021-29428: Fixed a local privilege escalation through system temporary directory. bsc1184807...

SUSE-SU-2023:1853-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2022-45143: Fixed JsonErrorReportValve injection bsc1206840...

SUSE-SU-2023:1844-1 Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: Update aws-nitro-enclaves-cli to version 1.2.2git0.4ccc639: CVE-2022-31394: Fixed DoS vulnerability in hyper crate bsc1208555. Update aws-nitro-enclaves-cli to version 1.2.0git2.841ef94: CVE-2022-24713: Fixed ReDoS vulnerability i...

PT-2023-22133 · Samsung · Exynos Modem 5300 +6

Name of the Vulnerable Software and Affected Versions: Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos 9110, and Exynos Auto T5123 Description: An issue was discovered in the mentioned Samsung Exynos processors...