Open Source Vulnerabilities

OpenObserve Privilege Escalation Vulnerability in Users API

OpenObserve Unauthorized Access Vulnerability in Users API

Cross-Site Scripting in WikiDiscover

github.com/hashicorp/nomad, github.com/hashicorp/nomad, github.com/hashicorp/nomad

HashiCorp Nomad vulnerable to symlink attacks

nomad, nomad

linux-gcp-5.4, linux-gcp

linux-gcp, linux-gcp-5.4 vulnerabilities

libecpg-compat3, libecpg-dev, libecpg6, libpgtypes3, libpq-dev, libpq5, postgresql-9.5, postgresql-client-9.5, postgresql-contrib-9.5, postgresql-doc-9.5, postgresql-plperl-9.5, postgresql-plpython-9.5, postgresql-plpython3-9.5, postgresql-pltcl-9.5, postgresql-server-dev-9.5

Fix CVE(s): CVE-2023-5869

openssh-client, openssh-client-ssh1, openssh-server, openssh-sftp-server, ssh, ssh-askpass-gnome, ssh-krb5

Fix CVE(s): CVE-2023-48795

libtomcat9-embed-java, libtomcat9-java, tomcat9, tomcat9-admin, tomcat9-common, tomcat9-docs, tomcat9-examples, tomcat9-user

Fix CVE(s): CVE-2023-46589

openssh-client, openssh-server, openssh-sftp-server, ssh, ssh-askpass-gnome

Fix CVE(s): CVE-2023-48795

Nomad Vulnerable to Arbitrary Write Through Symlink Attack

gnutls-bin, gnutls-doc, libgnutls-dane0, libgnutls-openssl27, libgnutls28-dev, libgnutls30, libgnutlsxx28

Fix CVE(s): CVE-2023-5981

lemon, sqlite, sqlite-analyzer, sqlite-devel, sqlite-doc, sqlite-libs, sqlite-tcl, sqlite-tools

sqlite: Fix of CVE-2023-7104

eza

eza Potential Heap Overflow Vulnerability for AArch64

github.com/rancher/apiserver

Rancher API Server Cross-site Scripting Vulnerability

github.com/rancher/norman

Norman API Cross-site Scripting Vulnerability

github.com/rancher/rancher, github.com/rancher/rancher, github.com/rancher/rancher

Rancher 'Audit Log' leaks sensitive information

github.com/rancher/rancher, github.com/rancher/rancher, github.com/rancher/rancher

Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

kinto-attachment

Kinto Attachment's attachments can be replaced on read-only records

ip, ip

NPM IP package incorrectly identifies some private IP addresses as public

PanelSwWix4.Sdk

PanelSwWix4.Sdk .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

PanelSW.Custom.WiX

Panel::Software Customized WiX .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

wix, wix

WiX Toolset's .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

libjwt, libjwt, libjwt

node-ip, node-ip, node-ip

nodejs

CVE-2023-42282 affecting package nodejs for versions less than 20.14.0-1

nodejs

CVE-2023-42282 affecting package nodejs for versions less than 16.20.2-3

nodejs18

CVE-2023-42282 affecting package nodejs18 for versions less than 18.18.2-4

reaper

CVE-2023-42282 affecting package reaper for versions less than 3.1.1-10

libjwt, libjwt, libjwt, libjwt, libjwt, libjwt, libjwt

php-jwt

python, python-base, python-doc, python, python-base, python-doc, python-base

Security update for python

python36-core, python36, python36-core, python36, python36-core

Security update for python36