Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-6701-3)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-3 advisory. A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux...
7.8CVSS
7.7AI Score
0.003EPSS
New emacs packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/emacs-29.3-i586-1_slack15.0.txz: Upgraded. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in...
7.8CVSS
7.9AI Score
0.001EPSS
Debian dla-3772 : idle-python3.7 - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3772 advisory. An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The...
7.8CVSS
6.6AI Score
0.0005EPSS
Debian dla-3771 : idle-python2.7 - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3771 advisory. An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to...
6.2CVSS
6.4AI Score
0.0005EPSS
Debian dsa-5646 : cacti - security update
The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5646 advisory. Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS)...
8.8CVSS
6.5AI Score
0.001EPSS
Debian dsa-5647 : ctdb - security update
The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5647 advisory. An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication,...
7.5CVSS
8.1AI Score
0.041EPSS
Slackware Linux 15.0 / current emacs Vulnerability (SSA:2024-084-01)
The version of emacs installed on the remote host is prior to 29.3. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-084-01 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because...
7.8CVSS
7.4AI Score
0.001EPSS
[slackware-security] mozilla-firefox
New mozilla-firefox packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-firefox-115.9.1esr-i686-1_slack15.0.txz: Upgraded. This update fixes a critical security issue: An attacker was...
7.1AI Score
0.0004EPSS
Debian dla-3769 : thunderbird - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3769 advisory. NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private...
7.5CVSS
9AI Score
0.001EPSS
Debian dsa-5645 : firefox-esr - security update
The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5645 advisory. An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This...
5.8AI Score
0.0004EPSS
Slackware Linux 15.0 / current mozilla-firefox Vulnerability (SSA:2024-083-01)
The version of mozilla-firefox installed on the remote host is prior to 115.9.1esr. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-083-01 advisory. An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript...
5.9AI Score
0.0004EPSS
Debian dla-3768 : python-pil - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3768 advisory. The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. (CVE-2021-23437) ...
9.8CVSS
7.5AI Score
0.007EPSS
Debian dsa-5644 : thunderbird - security update
The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5644 advisory. NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the...
7.5CVSS
9AI Score
0.001EPSS
This post-exploitation keylogger will covertly exfiltrate keystrokes to a server. These tools excel at lightweight exfiltration and persistence, properties which will prevent detection. It uses DNS tunelling/exfiltration to bypass firewalls and avoid detection. Server Setup The server uses...
7.5AI Score
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6708-1 advisory. Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. NOTE: ...
7.8CVSS
6.8AI Score
0.001EPSS
Ubuntu 22.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-6704-2)
The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6704-2 advisory. In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error...
7.8CVSS
7AI Score
0.004EPSS
Debian dsa-5643 : firefox-esr - security update
The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5643 advisory. NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the...
7.5CVSS
8.6AI Score
0.001EPSS
Ubuntu 16.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6700-2)
The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6700-2 advisory. In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with...
7.8CVSS
7AI Score
0.002EPSS
Ubuntu 18.04 LTS : OpenSSL vulnerabilities (USN-6709-1)
The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6709-1 advisory. Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(),...
5.5CVSS
7.2AI Score
0.003EPSS
Ubuntu 23.10 : Linux kernel (ARM laptop) vulnerabilities (USN-6707-2)
The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6707-2 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The...
7.8CVSS
7.7AI Score
0.002EPSS
7.8CVSS
7.1AI Score
0.001EPSS
New python3 packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/python3-3.9.19-i586-1_slack15.0.txz: Upgraded. This update fixes security issues: bundled libexpat was updated to 2.6.0. ...
7.8CVSS
7.4AI Score
0.001EPSS
Summary Vulnerabilities in Curl could allow a remote attacker to bypass security restrictions (CVE-2023-46218, CVE-2023-46219, CVE-2024-0853). PowerSC uses Curl as part of PowerSC Trusted Network Connect (TNC). Vulnerability Details ** CVEID: CVE-2023-46218 DESCRIPTION: **cURL libcurl could allow.....
6.5CVSS
7.3AI Score
0.001EPSS
Summary IBM Spectrum Protect Plus can be affected by vulnerabilities in Spring, Tomcat, Jackson, sudo, and Linux kernel. Vulnerabilities include obtaining sensitive information, gaining elevated privileges, executing arbitrary commands, denial of service, and bypassing security restrictions, as...
9.8CVSS
9.9AI Score
EPSS
Jupyter Server Proxy's Websocket Proxying does not require authentication
Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages (partial list) also use jupyter-server-proxy to expose other popular interactive...
9CVSS
7.9AI Score
0.0004EPSS
Jupyter Server Proxy's Websocket Proxying does not require authentication
Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages (partial list) also use jupyter-server-proxy to expose other popular interactive...
9CVSS
7.9AI Score
0.0004EPSS
MultiDump - Post-Exploitation Tool For Dumping And Extracting LSASS Memory Discreetly
MultiDump is a post-exploitation tool written in C for dumping and extracting LSASS memory discreetly, without triggering Defender alerts, with a handler written in Python. Blog post: https://xre0us.io/posts/multidump MultiDump supports LSASS dump via ProcDump.exe or comsvc.dll, it offers two...
7.4AI Score
[slackware-security] mozilla-thunderbird
New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-thunderbird-115.9.0-i686-1_slack15.0.txz: Upgraded. This release contains security fixes and improvements. ...
7.5CVSS
7.7AI Score
0.001EPSS
[slackware-security] mozilla-firefox
New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/mozilla-firefox-115.9.0esr-i686-1_slack15.0.txz: Upgraded. This update contains security fixes and improvements. For more...
7.5CVSS
7.7AI Score
0.001EPSS
New gnutls packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/gnutls-3.8.4-i586-1_slack15.0.txz: Upgraded. This update fixes two medium severity security issues: libgnutls: Fix side-channel in...
5.3CVSS
7AI Score
0.0005EPSS
Ubuntu 20.04 LTS : Firefox vulnerabilities (USN-6703-1)
The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6703-1 advisory. NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the...
8.8AI Score
0.0004EPSS
Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-6686-3)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6686-3 advisory. In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain...
7.8CVSS
7.2AI Score
EPSS
7.5CVSS
7.4AI Score
0.001EPSS
Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (GCP) vulnerabilities (USN-6701-2)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-2 advisory. A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock.c in the Linux...
7.8CVSS
7.7AI Score
0.003EPSS
Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6702-2)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6702-2 advisory. In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in...
7.8CVSS
6.8AI Score
0.002EPSS
Debian dla-3767 : imagemagick - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3767 advisory. A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the identify -help command. (CVE-2022-48541) Note that...
7.1CVSS
6.8AI Score
0.001EPSS
Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerability (USN-6706-1)
The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6706-1 advisory. A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub- component, net/usb/lan78xx in the Linux Kernel. This...
5.5CVSS
6.7AI Score
0.0004EPSS
5.3CVSS
5.4AI Score
0.0005EPSS
Releases Ubuntu 22.04 LTS Ubuntu 20.04 LTS Packages linux - Linux kernel linux-azure - Linux kernel for Microsoft Azure Cloud systems linux-azure-5.15 - Linux kernel for Microsoft Azure cloud systems linux-azure-fde - Linux kernel for Microsoft Azure CVM cloud systems linux-azure-fde-5.15 -...
7.8CVSS
8AI Score
0.004EPSS
Slackware Linux 15.0 / current python3 Multiple Vulnerabilities (SSA:2024-080-01)
The version of python3 installed on the remote host is prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-080-01 advisory. libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in...
7.8CVSS
6.8AI Score
0.001EPSS
Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6704-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6704-1 advisory. In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in...
7.8CVSS
7AI Score
0.004EPSS
7.5CVSS
7.4AI Score
0.001EPSS
Ubuntu 22.04 LTS / 23.10 : Linux kernel (AWS) vulnerabilities (USN-6680-3)
The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6680-3 advisory. In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c. (CVE-2023-46343) ...
7CVSS
7.2AI Score
0.003EPSS
Ubuntu 22.04 LTS / 23.10 : Linux kernel vulnerabilities (USN-6707-1)
The remote Ubuntu 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6707-1 advisory. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation....
7.8CVSS
7.7AI Score
0.002EPSS
Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6702-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6702-1 advisory. In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in...
7.8CVSS
7.1AI Score
0.002EPSS
Debian dsa-5642 : php-dompdf-svg-lib - security update
The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5642 advisory. php-svg-lib is an SVG file parsing / rendering library. Prior to version 0.5.1, when parsing the attributes passed to a use tag inside an svg document, an...
9.8CVSS
7.8AI Score
0.001EPSS
Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6705-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6705-1 advisory. In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain...
7.8CVSS
6.9AI Score
EPSS
Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6681-4)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6681-4 advisory. In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a move_data_page NULL...
7.8CVSS
7.2AI Score
0.003EPSS
Ubuntu 22.04 LTS : Linux kernel (KVM) vulnerabilities (USN-6686-4)
The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6686-4 advisory. In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and...
7.8CVSS
7.2AI Score
EPSS
Container escape at build time
Impact What kind of vulnerability is it? Who is impacted? Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed. Patches From @nalind ``` cat...
8.6CVSS
8.5AI Score
0.0005EPSS