CVE-2023-36622

The affected product is Loxone Miniserver Go Gen.2 (prior to 14.1.5.9). The vulnerability is a command-injection flaw in the websocket configuration endpoint, where remote authenticated administrators can inject arbitrary OS commands via the timezone parameter. This impacts confidentiality, integ...

CVE-2023-36624

Summary: CVE-2023-36624 affects Loxone Miniserver Go Gen.2 up to 14.0.3.28. An authenticated operating system user can escalate privileges via the Sudo configuration, allowing elevated execution of binaries without a password. What’s known from documents: Multiple sources (NVD/Red Hat/CVE listing...

PT-2023-25639 · Loxone · Loxone Miniserver Go Gen.2

Name of the Vulnerable Software and Affected Versions: Loxone Miniserver Go Gen.2 versions prior to 14.2 Description: The issue allows a local user to calculate the root password and escalate privileges due to the root password being calculated using hard-coded secrets and the MAC address...

CVE-2023-36622

The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter...

CVE-2023-36624

Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the elevated execution of binaries without a password requirement...

EulerOS 2.0 SP11 : golang (EulerOS-SA-2023-2292)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a...

Huawei EulerOS: Security Advisory for harfbuzz (EulerOS-SA-2023-2270)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP11 : haproxy (EulerOS-SA-2023-2269)

According to the versions of the haproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an...

Fedora 38 : golang-github-schollz-croc / golang-github-schollz-mnemonicode (2023-ac4651c9b2)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-ac4651c9b2 advisory. croc 9.6.4 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue b...

Rukovoditel 3.4.1 - Multiple Stored XSS Vulnerability

Exploit Title: Rukovoditel 3.4.1 - Multiple Stored XSS Version: 3.4.1 Bugs: Multiple Stored XSS Technology: PHP Vendor URL: https://www.rukovoditel.net/ Software Link: https://www.rukovoditel.net/download.php Date of found: 24-06-2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Detail...

Huawei EulerOS: Security Advisory for harfbuzz (EulerOS-SA-2023-2294)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-5445-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

kubernetes security update

kubernetes 1.24.8-2 - libct/cg: add misc controller to v1 drivers upstream runc patch 1.24.8-1 - Added Oracle specific build files for Kubernetes olcne 1.5.13-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.24.15 - Added script to support upgrade from OL7 to OL8 using leapp...

Amazon Linux 2 : glib2 (ALAS-2023-2107)

The version of glib2 installed on the remote host is prior to 2.56.1-9. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2107 advisory. PCRE before 8.38 mishandles the : and \ substrings in character classes, which allows remote attackers to cause a denial of...

Amazon Linux 2 : qpdf (ALAS-2023-2104)

The version of qpdf installed on the remote host is prior to 5.0.1-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2104 advisory. QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer overflow in PlASCII85Decoder::write called from PlAESPDF::flush...

Amazon Linux 2 : openldap (ALAS-2023-2095)

The version of openldap installed on the remote host is prior to 2.4.44-25. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2095 advisory. A vulnerability was found in openldap that can cause a null pointer dereference in the bermemallocx function. CVE-2023-2953...

Amazon Linux 2 : openssl11 (ALAS-2023-2097)

The version of openssl11 installed on the remote host is prior to 1.1.1g-12. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2097 advisory. Issue summary: Processing some specially crafted ASN.1 object identifiers ordata containing them may be very slow. Impact...

Amazon Linux 2 : perl-Pod-Perldoc (ALAS-2023-2094)

The version of perl-Pod-Perldoc installed on the remote host is prior to 3.20-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2094 advisory. HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configurati...

Amazon Linux 2 : qt (ALAS-2023-2090)

The version of qt installed on the remote host is prior to 4.8.5-15. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2090 advisory. An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS do...

Amazon Linux 2 : qt5-qtsvg (ALAS-2023-2092)

The version of qt5-qtsvg installed on the remote host is prior to 5.9.2-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2092 advisory. In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont munitsPerEm...