Security Advisories Notices Update on 2022-11-29

Amazon AWS Security Advisories

Jenkins Security Advisories

Jenkins Security Advisory 2022-11-15

Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 102.5 mfsa2022-49
Security Vulnerabilities fixed in Firefox ESR 102.5 mfsa2022-48
Security Vulnerabilities fixed in Firefox 107 mfsa2022-47

Amazon AWS Security Advisories

OpenSSL Security Advisories – November 2022

Google Security Advisories

Chrome Releases: Stable Channel Update for Desktop
Chrome Releases: Stable Channel Update for Desktop
Android Security Bulletin—November 2022 | Android Open Source Project
Chrome Releases: Stable Channel Update for Desktop
Chrome Releases: Stable Channel Update for Desktop
Chrome Releases: Stable Channel Update for Desktop
Chrome Releases: Stable Channel Update for Desktop

Apple Security Advisory

iOS 16.1.1 and iPadOS 16.1.1 Security Content
macOS Ventura 13.0.1 Security Content
Xcode 14.1 Security Content
iOS 15.7.1 and iPadOS 15.7.1 Security Content
Safari 16.1 Security Content
iOS 16.1 and iPadOS 16 Security Content
macOS Big Sur 11.7.1 Security Content
macOS Monterey 12.6.1 Security Content
macOS Ventura 13 Security Content
tvOS 16.1 Security Content
watchOS 9.1 Security Content

National Cyber Awareness System

Ubuntu Security Notices

Red Hat Security Advisory

Node.js Security Advisories

Nov 3 2022 Security Releases
OpenSSL November Security Release
OpenSSL and zlib update assessment, and Node.js Assessment workflow

Cisco Security Advisory

Microsoft Security

Github Security Advisories

[GHSA-562r-vg33-8x8h] TemporaryFolder on unix-like systems does not limit access to created files
[GHSA-gpv5-rp6w-58r8] Remote code execution vulnerability in dependency System.Drawing.Common
[GHSA-8w5g-3wcv-9g2j] Tensorflow vulnerable to Out-of-Bounds Read
[GHSA-r7qp-cfhv-p84w] Uncaught exception in engine.io
[GHSA-7x4w-j98p-854x] Cross site scripting vulnerability with discussion titles
[GHSA-cqvq-fvhr-v6hc] `CHECK` failure in `SobolSample` via missing validation
[GHSA-xf83-q765-xm6m] `CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode
[GHSA-q6jp-gcww-8v2j] Missing Authorization in Filter Stream Converter Application
[GHSA-p88w-fhxw-xvcc] Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server
[GHSA-p2x4-6ghr-6vmq] Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui
[GHSA-6w8h-26xx-cf8q] Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) in org.xwiki.platform:xwiki-platform-menu-ui
[GHSA-q2hm-2h45-v5g3] Plaintext storage of password after a reset in org.xwiki.platform:xwiki-platform-security-authentication-default
[GHSA-4x5r-6v26-7j4v] Creation of new database tables through login form on PostgreSQL
[GHSA-5j7g-cf6r-g2h7] Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) in xwiki-platform-icon-ui
[GHSA-p5v9-g8w8-5q4v] Missing Authorization to enable or disable users in org.xwiki.platform:xwiki-platform-user-profile-ui
[GHSA-2gj2-vj98-j2qq] Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore
[GHSA-9hqh-fmhg-vq2j] Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) in AttachmentSelector.xml
[GHSA-mq7h-5574-hw9f] Cross-Site Request Forgery (CSRF) allowing to delete or rename tags
[GHSA-qccm-wmcq-pwr6] Tailscale daemon is vulnerable to information disclosure via CSRF
[GHSA-vqp6-rc3h-83cp] Tailscale Windows daemon is vulnerable to RCE via CSRF
[GHSA-442f-wcwq-fpcf] Prevent RCE when deserializing untrusted user input
[GHSA-pp3f-xrw5-q5j4] Lancet vulnerable to path traversal when unzipping files
[GHSA-3fjj-p79j-c9hh] Fastify: Incorrect Content-Type parsing can lead to CSRF attack
[GHSA-pf36-r9c6-h97j] Invalid char to bool conversion when printing a tensor
[GHSA-frqp-wp83-qggv] Heap overflow in `QuantizeAndDequantizeV2`
[GHSA-rjx6-v474-2ch9] Segfault in `CompositeTensorVariantToComponents`
[GHSA-mv77-9g28-cwg3] `CHECK` fail via inputs in `PyFunc`
[GHSA-368v-7v32-52fx] Overflow in `ResizeNearestNeighborGrad`
[GHSA-cg88-rpvp-cjv5] Out of bounds write in grappler in Tensorflow
[GHSA-g9fm-r5mm-rf9f] `CHECK_EQ` fail via input in `SparseMatrixNNZ`
[GHSA-xvwp-h6jv-7472] FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess
[GHSA-27rc-728f-x5w2] `CHECK` fail via inputs in `SdcaOptimizer`
[GHSA-hq7g-wwwp-q46h] `CHECK` fail via inputs in `SparseFillEmptyRowsGrad`
[GHSA-f2w8-jw48-fr7j] `FractionalMaxPoolGrad` Heap out of bounds read
[GHSA-rmg2-f698-wq35] `tf.raw_ops.Mfcc` crashes
[GHSA-gq2j-cr96-gvqx] `MirrorPadGrad` heap out of bounds read
[GHSA-h6q3-vv32-2cq5] Buffer overflow in `CONV_3D_TRANSPOSE` on TFLite
[GHSA-67pf-62xr-q35m] `CHECK_EQ` fail in `tf.raw_ops.TensorListResize`
[GHSA-66vq-54fq-6jvv] Segfault in `tf.raw_ops.TensorListConcat`
[GHSA-h246-cgh4-7475] `CHECK` fail in `BCast` overflow
[GHSA-xxcj-rhqg-m46g] Segfault via invalid attributes in `pywrap_tfe_src.cc`
[GHSA-6×99-gv2v-q76v] FPE in `tf.image.generate_bounding_box_proposals`
[GHSA-8fvv-46hw-vpg3] Overflow in `tf.keras.losses.poisson`
[GHSA-54pp-c6pp-7fpx] Overflow in `ImageProjectiveTransformV2`
[GHSA-762h-vpvw-3rcx] Overflow in `FusedResizeAndPadConv2D`
[GHSA-jq6x-99hj-q636] Seg fault in `ndarray_tensor_bridge` due to zero and large inputs
[GHSA-w58w-79xv-6vcj] Out of bounds segmentation fault due to unequal op inputs in Tensorflow
[GHSA-3w3h-7xgx-grwc] Leakage Aliyun KeySecret
[GHSA-6cqj-6969-p57x] Lack of proper validation of server UUID can be used by the server to trick the client to accept invalid proofs
[GHSA-672p-m5jq-mrh8] Insufficient Verification of Proofs generated by the immudb server in client SDK.
[GHSA-hc82-w9v8-83pr] Witness Block Parsing DoS Vulnerability
[GHSA-m5xf-x7q6-3rm7] List helm chart endpoint of VelaUX APIserver has SSRF vulnerability
[GHSA-xx6g-jj35-pxjv] Cross Site Scripting vulnerability in wsgidav when directory browsing is enabled
[GHSA-prjq-f4q3-fvfr] gosaml2 is vulnerable to NULL Pointer Dereference
[GHSA-gmpq-xrxj-xh8m] Arches vulnerable to execution of arbitrary SQL
[GHSA-vp35-85q5-9f25] Container build can leak any path on the host into the container
[GHSA-99r3-xmmq-7q7g] eZ Platform users with the Company admin role can assign any role to any user
[GHSA-8h83-chh2-fchp] eZ Platform users with the Company admin role can assign any role to any user
[GHSA-446q-xxg5-3vhh] eZ Platform users with the Company admin role can assign any role to any user
[GHSA-pcpm-vc4v-cmvx] eZ Platform users with the Company admin role can assign any role to any user
[GHSA-g6jc-xrc3-4wwq] Ibexa DXP users with the Company admin role can assign any role to any user
[GHSA-394j-x37r-2q27] Ibexa DXP users with the Company admin role can assign any role to any user
[GHSA-7644-cxp8-h23r] ibexa/admin-ui vulnerable to Cross-site Scripting in content type name/shortname
[GHSA-c7pc-pgf6-mfh5] ezplatform-graphql GraphQL queries can expose password hashes
[GHSA-58h5-h554-429q] ezplatform-admin-ui vulnerable to Cross-Site Scripting (XSS)
[GHSA-3p7g-wrgg-wq45] GraphQL queries can expose password hashes
[GHSA-rc39-g977-687w] Use of unclaimed s3 bucket in tests and examples
[GHSA-wh6w-3828-g9qf] Wasmtime may have data leakage between instances in the pooling allocator
[GHSA-44mr-8vmm-wjhg] Wasmtime out of bounds read/write with zero-memory-pages configuration
[GHSA-98pf-gfh3-x3mp] Read the Docs vulnerable to Cross-Site Scripting (XSS)
[GHSA-3qmc-2r76-4rqp] Redwood is vulnerable to account takeover via dbAuth “forgot-password”
[GHSA-93vw-8fm5-p2jf] Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
[GHSA-p2jh-44qj-pf2v] Exfiltration of hashed SMB credentials on Windows via file:// redirect
[GHSA-6c6p-h79f-g6p4] Istio may allow identity impersonation if user has localhost access
[GHSA-xprv-wvh7-qqqx] Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers
[GHSA-5m7g-pj8w-7593] Vela Insecure Defaults
[GHSA-p72g-cgh9-ghjg] Failing DTLS handshakes may cause throttling to block processing of records
[GHSA-8g2p-5pqh-5jmc] .NET Information Disclosure Vulnerability
[GHSA-3gfj-fxx4-f22w] OpenFGA Authorization Bypass
[GHSA-r4jg-5v89-9v62] Octocat.js vulnerable to code injection
[GHSA-q9wv-22m9-vhqh] Tauri Filesystem Scope can be Partially Bypassed
[GHSA-prm5-8g2m-24gg] Remote code execution via MongoDB BSON parser through prototype pollution
[GHSA-4pcg-wr6c-h9cq] fastify/websocket vulnerable to uncaught exception via crash on malformed packet
[GHSA-m7gv-v8xx-v47w] XWiki OIDC Authenticator vulnerable to bypassing OpenID login by providing a custom provider
[GHSA-25mx-2mxm-6343] @keystone-6/core’s NODE_ENV defaults to development with esbuild
[GHSA-8r69-3cvp-wxc3] Batched HTTP requests may set incorrect `cache-control` response header
[GHSA-fppq-mj76-fpj2] fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)
[GHSA-mcmr-49×3-4jqm] ckb type_id script resume may randomly fail
[GHSA-7fw6-6mfj-g3q2] ckb: Transaction header_deps validation issue (network forking)
[GHSA-9mfc-chwf-7whf] ckb: Large dep group requires a lot of resources to process but the cost to commit the transaction is very low.
[GHSA-39hc-v87j-747x] Vulnerable OpenSSL included in cryptography wheels
[GHSA-rcrx-fpjp-mfrw] Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
[GHSA-8q72-6qq8-xv64] phpCAS vulnerable to Service Hostname Discovery Exploitation
[GHSA-crh6-fp67-6883] xmldom allows multiple root nodes in a DOM
[GHSA-r8gm-v65f-c973] acryl-datahub missing JWT signature check
[GHSA-pmw9-567p-68pc] OctoRPKI crashes when max iterations is reached
[GHSA-9398-5ghf-7pr6] conduit-hyper vulnerable to Denial of Service from unchecked request length
[GHSA-5qxq-vgmm-q39m] RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
[GHSA-hff2-x2j9-gxgv] Keylime: unhandled exceptions could lead to invalid attestation states
[GHSA-3fh5-q6fg-w28q] Prototype pollution in Snowboard framework
[GHSA-vg46-2rrj-3647] Twisted vulnerable to NameVirtualHost Host header injection
[GHSA-m678-f26j-3hrp] Execution with Unnecessary Privileges in JupyterApp
[GHSA-cr84-xvw4-qx3c] Inefficient Regular Expression Complexity in shescape
[GHSA-hhc4-47rh-cr34] Incorrect is_static parameter for custom stateful precompiles in SputnikVM (evm)
[GHSA-7gc4-r5jr-9hxv] Gin-vue-admin subject to Remote Code Execution via file upload vulnerability
[GHSA-f2rj-m42r-6jm2] Skipper vulnerable to SSRF via X-Skipper-Proxy
[GHSA-c33w-pm52-mqvf] @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details
[GHSA-vj4m-83m8-xpw5] OpenFGA Authorization Bypass via tupleset wildcard
[GHSA-f4mm-2r69-mg5f] OpenFGA Authorization Bypass
[GHSA-95×7-mh78-7w2r] OpenFGA subject to Information Disclosure via streamed-list-objects endpoint
[GHSA-47xc-9rr2-q7p4] Improper Control of Generation of Code (‘Code Injection’) in Azure CLI
[GHSA-2c6m-6gqh-6qg3] Docker Command Escaping in the GitHub Actions Runner
[GHSA-rh58-r7jh-xhx3] .NET Core Elevation of Privilege Vulnerability

CISA Known Exploted Vulnerabilities

Amazon AWS Security Advisories

Jenkins Security Advisories

Mozilla Security Advisories

Amazon AWS Security Advisories

Google Security Advisories

Apple Security Advisory

National Cyber Awareness System

Ubuntu Security Notices

Red Hat Security Advisory

Node.js Security Advisories

Cisco Security Advisory

Microsoft Security

Github Security Advisories

CISA Known Exploted Vulnerabilities

It looks like you are using an adblocker.