MGASA-2023-0153 Updated dnsmasq packages fix security vulnerability

A flaw was found in Dnsmasq. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. CVE-2023-28450...

Debian: Security Advisory (DLA-3394-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-23879

Cross-Site Request Forgery CSRF vulnerability in Nicolas Zeh PHP Execution plugin = 1.0.0 versions...

@chargeover/strapi (=0.0.1-rc1.1), @cowprotocol/cms (=0.1.0-rc.5) +27 more potentially affected by CVE-2023-22893 via @strapi/plugin-users-permissions (>=4.0.0-beta.0 <=4.5.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.1.1, =0.0.1, =0.1.0, =1.0.10, =4.3.15 - robsen-strapi-site =0.1.0 - sneakmax =0.1.0 and more Source cves: CVE-2023-22893 Source advisory: OSV:GHSA-583X-23H9-F5W7...

AIX : Multiple Vulnerabilities (IJ45059)

The version of AIX installed on the remote host is prior to APAR IJ45059. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ45059 advisory. - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key,...

@chargeover/strapi (=0.0.1-rc1.1), @cowprotocol/cms (=0.1.0-rc.5) +27 more potentially affected by unknown CVE via @strapi/plugin-users-permissions (>=4.0.0-beta.0 <=4.5.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.1.1, =0.0.1, =0.1.0, =1.0.10, =4.3.15 - robsen-strapi-site =0.1.0 - sneakmax =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XV3Q-JRMM-4FXV...

AIX (IJ45224)

The version of AIX installed on the remote host is prior to APAR IJ45224. It is, therefore, affected by a vulnerability as referenced in the IJ45224 advisory. - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify tha...

EulerOS 2.0 SP8 : mod_security (EulerOS-SA-2023-1601)

According to the versions of the modsecurity package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application...

CVE-2023-1668

A flaw was found in openvswitch OVS. When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results for both kernel and userspace datapath in installing a datapath flow matching all IP protocols nwproto is wildcarded...

D-Link DIR-846 - Remote Command Execution Vulnerability

Exploit Title: D-Link DIR-846 - Remote Command Execution RCE vulnerability Exploit Author: Françoa Taffarel Vendor Homepage: https://www.dlink.com.br/produto/roteador-dir-846-gigabit-wi-fi-ac1200/suportehttps://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip Software...

D-Link DIR-846 - Remote Command Execution (RCE) vulnerability

Exploit Title: D-Link DIR-846 - Remote Command Execution RCE vulnerability Google Dork: NA Date: 30/01/2023 Exploit Author: Françoa Taffarel Vendor Homepage:...

GHSA-33PG-M6JH-5237 vulnerabilities

Vulnerabilities for packages: ctop, up, melange, ko, helm, apko, bom...

GHSA-6WRF-MXFJ-PF5P vulnerabilities

Vulnerabilities for packages: ctop, up, melange, ko, helm, apko, bom...

Virtuozzo Hybrid Infrastructure 5.4 Update 1 Hotfix 1 (5.4.1-61)

This update provides stability fixes for the compute service. Vulnerability id: VSTOR-66686 If there is a network port with the address 0.0.0.0/0, a VM creation fails with the error 'Failed to allocate the networks, not rescheduling.' Vulnerability id: VSTOR-67068 Snapshot metrics per storage...

PT-2023-6900

Name of the Vulnerable Software and Affected Versions net.sourceforge.htmlunit:htmlunit versions 0 through 3.0.0 Description The issue is related to incorrect code generation management in the HtmlUnit browser, which can be exploited to execute arbitrary code remotely via XSTL when browsing an...

CVE-2022-28686

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 04201.2111.1802.0000. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

Debian dla-3366 : tzdata - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3366 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3366-1 [email protected] https://www.debian.org/lts/security/...

Chinese Hackers Exploiting 0-day Vulnerability in Fortinet Products

By Deeba Ahmed According to researchers, multiple Fortinet products were impacted by this vulnerability, including FortiManager, FortiGate, and FortiAnalyzer. This is a post from HackRead.com Read the original post: Chinese Hackers Exploiting 0-day Vulnerability in Fortinet Products...

CVE-2023-28450

A flaw was found in Dnsmasq. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020. Mitigation Systems that can not be updated can still configure dnsmasq to use the recommended maximum EDNS value by setting edns-packet-max=1232 in the dnsmasq...

Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems

Posted by Tim Willis, Project Zero In late 2022 and early 2023, Project Zero reported eighteen 0-day vulnerabilities in Exynos Modems produced by Samsung Semiconductor. The four most severe of these eighteen vulnerabilities CVE-2023-24033, CVE-2023-26496, CVE-2023-26497 and CVE-2023-26498 allowed...