Skip to content
OpenAdvisories
Medium WID-SEC-2023-0266 9 CVEs

genua genucenter: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Feb 2, 2023 · Updated Oct 11, 2026 · Revision 3 · de-DE

Vendor: genua Vendor: Oracle Product: genucenter Product: Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in genua genucenter ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

genucenter bietet eine zentrale und rollenbasierte Administration der Lösungen von genua.

Vulnerabilities 9

  • High 7.8
    CVE-2023-22809 Public exploit EPSS 55%

    In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environme…

    sudo sudo sudo sudo Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2022-44570

    Denial of service via header parsing in Rack

    A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vec…

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • High 7.2
    CVE-2022-23519

    Possible XSS vulnerability with certain configurations of rails-html-sanitizer

    rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application deve…

    rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-23515

    Improper neutralization of data URIs may allow XSS in Loofah

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in v…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-23518

    Improper neutralization of data URIs allows XSS in rails-html-sanitizer

    rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.

    rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-23520

    rails-html-sanitizer contains an incomplete fix for an XSS vulnerability

    rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Htm…

    rails rails-html-sanitizer rails-html-sanitizer ruby-rails-html-sanitizer Debian Ubuntu RubyGems
  • Unscored —
    CVE-2022-27881

    engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router adverti…

  • Unscored —
    CVE-2022-27882

    slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflo…

  • Unscored —
    CVE-2022-28739

    There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occ…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine

Revision history

  1. #3

    Neue Updates von Oracle Linux aufgenommen

  2. #2

    Korrektur betroffene Software und ausnutzbare CVE

  3. #1

    Initiale Fassung

References