Security Advisories Notices Update on 2022-12-20

Amazon AWS Security Advisories

Jenkins Security Advisories

Jenkins Security Advisory 2022-12-07

Node.js Security Advisories

Apple Security Advisory

macOS Ventura 13.1 Security Content
iOS 16.2 and iPadOS 16.2 Security Content
iOS 15.7.2 and iPadOS 15.7.2 Security Content
watchOS 9.2 Security Content
tvOS 16.2 Security Content
macOS Big Sur 11.7.2 Security Content
macOS Monterey 12.6.2 Security Content
Safari 16.2 Security Content
iCloud for Windows 14.1 Security Content

Cisco Security Advisory

National Cyber Awareness System

Samba Releases Security Updates
FBI, FDA OCI, and USDA Release Joint Cybersecurity Advisory Regarding Business Email Compromise Schemes Used to Steal Food
CISA Releases Forty-One Industrial Control Systems Advisories
Drupal Releases Security Updates to Address Vulnerabilities in H5P and File (Field) Paths
CISA Consolidates Twitter Accounts
CISA Adds One Known Exploited Vulnerability to Catalog
Apple Releases Security Updates for Multiple Products
Microsoft Releases December 2022 Security Updates
CISA Updates Advisory on #StopRansomware: Cuba Ransomware
Citrix Releases Security Updates for Citrix ADC, Citrix Gateway
Mozilla Releases Security Updates for Thunderbird and Firefox
VMware Releases Security Updates for Multiple products
CISA Adds Five Known Exploited Vulnerabilities to Catalog
NSA, CISA, and ODNI Release Guidance on Potential Threats to 5G Network Slicing
CISA Releases Three Industrial Control Systems Advisories
Fortinet Releases Security Updates for FortiOS
Cisco Releases Security Advisory for IP Phone 7800 and 8800 Series
CISA Releases Phishing Infographic
CISA Releases Three Industrial Control Advisories
CISA Adds One Known Exploited Vulnerability to Catalog
#StopRansomware: Cuba Ransomware
CISA Releases Three Industrial Control Systems Advisories
CISA Releases Seven Industrial Control Systems Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog

Mozilla Security Advisories

Security Vulnerabilities fixed in Firefox 108 mfsa2022-51
Security Vulnerabilities fixed in Firefox ESR 102.6 mfsa2022-52
Security Vulnerabilities fixed in Thunderbird 102.6 mfsa2022-53
Security Vulnerabilities fixed in Thunderbird 102.5.1 mfsa2022-50

Ubuntu Security Notices

Red Hat Security Advisory

Microsoft Security

Google Security Advisories

Chrome Releases: Stable Channel Update for Desktop
Android Security Bulletin—December 2022 | Android Open Source Project
Chrome Releases: Stable Channel Update for Desktop
Chrome Releases: Stable Channel Update for Desktop

Github Security Advisories

[GHSA-2c7v-qcjp-4mg2] .NET Remote Code Execution Vulnerability
[GHSA-67fx-wx78-jx33] Helm vulnerable to denial of service through schema file
[GHSA-53c4-hhmh-vw5q] Helm vulnerable to denial of service through through repository index file
[GHSA-6rx9-889q-vv2r] Helm vulnerable to denial of service through string value parsing
[GHSA-xqqc-c5gw-c5r5] Tendermint light client verification not taking into account chain ID
[GHSA-g8q8-fggx-9r3q] Keycloak vulnerable to path traversal via double URL encoding
[GHSA-97g8-xfvw-q4hg] Keycloak vulnerable to session takeover with OIDC offline refreshtokens
[GHSA-rrfc-7g8p-99q8] Possible XSS vulnerability with certain configurations of rails-html-sanitizer
[GHSA-9h9g-93gc-623h] Possible XSS vulnerability with certain configurations of rails-html-sanitizer
[GHSA-mcvf-2q2m-x72m] Improper neutralization of data URIs may allow XSS in rails-html-sanitizer
[GHSA-5×79-w82f-gw8w] Inefficient Regular Expression Complexity in rails-html-sanitizer
[GHSA-3x8r-x6xp-q4vm] Uncontrolled Recursion in Loofah
[GHSA-228g-948r-83gx] Improper neutralization of data URIs may allow XSS in Loofah
[GHSA-486f-hjj9-9vhh] Inefficient Regular Expression Complexity in Loofah
[GHSA-ppjq-qxhx-m25f] Authentication Bypass for WSFed
[GHSA-8w3p-qh3x-6gjr] TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
[GHSA-c5wx-6c2c-f7rm] TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
[GHSA-mgj2-q8wp-29rr] TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset
[GHSA-jfp7-79g7-89rf] TYPO3 CMS vulnerable to Weak Authentication in Frontend Login
[GHSA-8c28-5mp7-v24h] TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
[GHSA-hvwx-qh2h-xcfj] TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting
[GHSA-52h2-m2cf-9jh6] linux-loader reading beyond EOF could lead to infinite loop
[GHSA-9v25-r5q2-2p6w] Candy Machine Set Collection During Mint Missing Check
[GHSA-8r76-fr72-j32w] Creator Verification Error when Bubblegum Activate
[GHSA-6jqm-3c9g-pch7] @cubejs-backend/api-gateway row level security bypass
[GHSA-jv85-mqxj-3f9j] Sentry vulnerable to invite code reuse via cookie manipulation
[GHSA-hh82-3pmq-7frp] Netty vulnerable to HTTP Response splitting from assigning header value iterator
[GHSA-fx2c-96vj-985v] HAProxyMessageDecoder Stack Exhaustion DoS
[GHSA-mjmj-j48q-9wg2] SnakeYaml Constructor Deserialization Remote Code Execution
[GHSA-j8x2-2m5w-j939] Amazon CloudWatch Agent for Windows has Privilege Escalation Vector
[GHSA-w3x5-427h-wfq6] Spring Boot Admins integrated notifier support allows arbitrary code execution
[GHSA-w9wc-4xcq-8gr6] Akeneo PIM Community Edition vulnerable to remote php code execution
[GHSA-gg8r-xjwq-4w92] Cross-site scripting vulnerability in TinyMCE alerts
[GHSA-x39j-h85h-3f46] go-merkledag’s ProtoNode may be modified such that common method calls may panic
[GHSA-9qgp-9wwc-v29r] PrestaShop has potential Information exposure in the upload directory
[GHSA-h2ph-vhm7-g4hp] Traefik may display authorization header in the debug logs
[GHSA-468w-8×39-gj5v] Traefik routes exposed with an empty TLSOption
[GHSA-c4pm-63cg-9j7h] Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List
[GHSA-qv4q-mr5r-qprj] Unchecked return value from xmlTextReaderExpand
[GHSA-f44q-634c-jvwv] libp2p DoS vulnerability from lack of resource management
[GHSA-2qjp-425j-52j9] containerd CRI stream server vulnerable to host memory exhaustion via terminal
[GHSA-j7qp-mfxf-8xjw] libp2p DoS vulnerability from lack of resource management
[GHSA-43fp-rhv2-5gv8] Certifi removing TrustCor root certificate
[GHSA-jvgw-gccv-q5p8] libp2p DoS vulnerability from lack of resource management
[GHSA-vx2x-9cff-fhjw] DSInternals Credential Roaming Elevation of Privilege Vulnerability
[GHSA-mhhf-vgwh-fw9h] Passeo uses insecure random number generator
[GHSA-xr7p-8q82-878q] teler dashboard vulnerable to DOM-based cross-site scripting (XSS)
[GHSA-78m5-jpmf-ch7v] GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package
[GHSA-x45c-cvp8-q4fm] Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace
[GHSA-rf3g-v8p5-p675] NodeBB vulnerable to account takeover via prototype vulnerability
[GHSA-4v48-4q5m-8vx4] Prometheus vulnerable to basic authentication bypass
[GHSA-qqff-4vw4-f6hx] Cap’n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list
[GHSA-2r7v-cmch-5×26] muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference
[GHSA-qv6c-367r-3w6q] XBlock vulnerable to Cross-Site Scripting (XSS)
[GHSA-7rg2-cxvp-9p7p] Prometheus Exporter-Toolkit is vulnerable to authentication bypass
[GHSA-rp2v-v467-q9vq] GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package
[GHSA-47xh-qxqv-mgvg] kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF)
[GHSA-r3qr-vwvg-43f7] Authenticated OpenRedirect Vulnerability
[GHSA-2x8x-jmrp-phxw] Sinatra vulnerable to Reflected File Download attack
[GHSA-j2jp-wvqg-wc2g] crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication
[GHSA-755v-r4x4-qf7m] Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
[GHSA-ggrh-grj3-vfvw] Package discontinued because Bitly lowered the free quota
[GHSA-395x-wv32-44v5] baserproject/basercms vulnerable to cross-site scripting (XSS) vulnerability
[GHSA-jf2p-4gqj-849g] Temporary File Information Disclosure vulnerability in MPXJ
[GHSA-9gh8-wp53-ccc6] ghost vulnerable to unauthorized newsletter modification via improper access controls

CISA Known Exploted Vulnerabilities

Amazon AWS Security Advisories

Jenkins Security Advisories

Node.js Security Advisories

Apple Security Advisory

Cisco Security Advisory

National Cyber Awareness System

Mozilla Security Advisories

Ubuntu Security Notices

Red Hat Security Advisory

Microsoft Security

Google Security Advisories

Github Security Advisories

CISA Known Exploted Vulnerabilities

It looks like you are using an adblocker.