13955 matches found
SUSE-SU-2023:1834-1 Security update for cmark
This update for cmark fixes the following issues: - CVE-2023-22486: Fixed quadratic complexity in handleclosebracket may lead to a denial of service bsc1207674...
Huawei EulerOS: Security Advisory for lxc (EulerOS-SA-2023-1600)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Updated tigervnc/x11-server packages fix security vulnerability
A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window aka COW, the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-fr...
Advisory ROSA-SA-2023-2151
Software: java-11-openjdk 11.0.18.0.10-1 OS: rosa-server79 packageevrstring: 11.0.18.0.10-1 CVE-ID: CVE-2022-39399 BDU-ID: None CVE-Crit: LOW CVE-DESC: A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Java SE, Oracle GraalVM...
SUSE-SU-2023:1814-1 Security update for podman
This update for podman fixes the following issues: Update to version 4.4.4: libpod: always use direct mapping macos pkginstaller: do not fail when podman-mac-helper fails podman-mac-helper: install: do not error if already installed - podman.spec: Bump required version for libcontainers-common...
PT-2023-36140 · Amazon · Amazon-Ssm-Agent
Name of the Vulnerable Software and Affected Versions: amazon-ssm-agent affected versions not specified Description: The issue is related to security problems that were fixed by rebuilding the software using go1.19.7, which resolved bugs and security issues. Recommendations: At the moment, there ...
CVE-2023-23762 Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling
An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff. To do so, an attacker would need write access to the repository and be able to correctly guess the target branch before it’s created by the code...
PT-2023-21389 · Ibm · Ibm Tririga
Name of the Vulnerable Software and Affected Versions: IBM TRIRIGA version 4.0 Description: The issue allows a remote attacker to exploit an XML external entity injection XXE attack when processing XML data, potentially exposing sensitive information or consuming memory resources. Recommendations...
MGASA-2023-0124 Updated peazip packages fix security vulnerability
Denial of service via the End of Archive tag function of the peazip/pea UNPEA feature. CVE-2023-24785...
CVE-2023-29016 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when using nicknames. An attacker could create a user account and enter malicious scripts int...
CVE-2023-29015 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting ...
Site Reviews < 6.7.1 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Login as Admin. 2. Go to...
PT-2023-3266 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions 0.50 through 9.5.12 GLPI versions 10.0.0 through 10.0.6 Description: The issue is related to a SQL Injection vulnerability that allows users with access rights to statistics or reports to extract all data from the database and, ...
Important: Red Hat Security Advisory: tigervnc security update
An update for tigervnc is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
PT-2023-21847 · Samsung · Exynos Modem 5300 +2
Name of the Vulnerable Software and Affected Versions: Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300 Description: An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor. An integer overflow in IPv4...
ALSA-2023:1551 Important: tigervnc security update
Virtual Network Computing VNC is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients...
PT-2023-9779 · Mitsubishi · Gc-Enet-Com
Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric India GC-ENET-COM versions with the first 2 digits of the 11-digit serial number of the unit being "16" Description: The issue is related to a Signal Handler Race Condition that allows a remote unauthenticated attacker to...
SUSE: Security Advisory (SUSE-SU-2023:1703-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Vulnerabilities fixed in QNAP QTS and QuTS hero
QNAP has fixed vulnerabilities in QTS and QuTS hero, the operating system for QNAP NAS devices. An authenticated malicious person could exploit the vulnerabilities to cause a denial-of-service, or grant themselves elevated privileges and thus gain access to sensitive data or execute arbitrary cod...