13727 matches found
CVE-2023-42754
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer skb was assumed to be associated with a device before calling ipoptionscompile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAPNETADMIN privileges t...
Important: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.0 security and bug fix update
The Migration Toolkit for Containers MTC 1.8.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance
Microsoft has detailed a new campaign in which attackers unsuccessfully attempted to move laterally to a cloud environment through an SQL Server instance. "The attackers initially exploited a SQL injection vulnerability in an application within the target's environment," security researchers...
Defending new vectors: Threat actors attempt SQL Server to cloud lateral movement
Microsoft security researchers recently identified a campaign where attackers attempted to move laterally to a cloud environment through a SQL Server instance. This attack technique demonstrates an approach weve seen in other cloud services such as VMs and Kubernetes cluster, but not in SQL Serve...
Unable to turn off the maintenance mode for Azure hosting connection after upgrading DDC's to 2203
Getting an error "Attempt to perform the operation failed. The license in use by the connection is invalid" while trying to turn off the maintenance mode for Azure hosting connection after upgrading DDC's to 2203...
Ubuntu: Security Advisory (USN-6396-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Microsoft AI Researchers Accidentally Expose 38 Terabytes of Confidential Data
Microsoft on Monday said it took steps to correct a glaring security gaffe that led to the exposure of 38 terabytes of private data. The leak was discovered on the company's AI GitHub repository and is said to have been inadvertently made public when publishing a bucket of open-source training...
Microsoft AI researchers accidentally exposed terabytes of sensitive data
Warnings about including credentials, keys, and tokens when sharing code on publicly accessible repositories shouldnt be necessary. It should speak for itself that you dont just hand over the keys to your data. But what if a misconfiguration ends in a supposed internal storage account becoming...
How To Enable DsAuthAzureAdNestedGroups Feature For Azure AD Nested Groups
Adding a group as a member of another group nesting is supported with the DSAuthAzureAdNestedGroups feature enabled...
Catalog Creation or Change Master Image fails when attempting to create ProvVM
Machine Creation Services actions, such as catalog creation, master image change, or adding additional VMs, may error unexpectedly for failure to create image preparation machine. CDF traces may indicate one of the following: "Error: creating virtual machine failed. AzureWriter-1 timed out while...
The vulnerability of the MachinePropertyBag class in the Azure DevOps Server software allows a hacker to execute arbitrary code.
The vulnerability of the MachinePropertyBag class in the Azure DevOps Server development tool is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Microsoft Azure HDInsight Apache Ambari Elevation of Privilege Vulnerability
Microsoft Azure is a set of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft. An elevation of privilege vulnerability exists in Microsoft Azure HDInsight Apache Ambari, which can be exploited by an attacker to gain domain administrator privileges...
The vulnerability of Microsoft Azure Kubernetes operating systems for Windows is related to deficiencies in access control, allowing attackers to escalate their privileges.
The vulnerability of Microsoft Azure Kubernetes operating systems for Windows is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...
The vulnerability of the Azure DevOps Server software lies in insufficient validation of input data, allowing a hacker to execute arbitrary code.
The vulnerability of the Azure DevOps Server software lies in insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using specially created data...
Security Updates for Microsoft Team Foundation Server and Azure DevOps Server (September 2023)
The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by multiple server remote code execution vulnerabilities. An authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Note that Ness...
Alert: New Kubernetes Vulnerabilities Enable Remote Attacks on Windows Endpoints
Three interrelated high-severity security flaws discovered in Kubernetes could be exploited to achieve remote code execution with elevated privileges on Windows endpoints within a cluster. The issues, tracked as CVE-2023-3676, CVE-2023-3893, and CVE-2023-3955, carry CVSS scores of 8.8 and impact...
Researchers Detail 8 Vulnerabilities in Azure HDInsight Analytics Service
More details have emerged about a set of now-patched cross-site scripting XSS flaws in the Microsoft Azure HDInsight open-source analytics service that could be weaponized by a threat actor to carry out malicious activities. "The identified vulnerabilities consisted of six stored XSS and two...
Patch now! September Microsoft Patch Tuesday includes two actively exploited zero-days
Microsoft's September 2023 Patch Tuesday is another important one. Not because it's a busy one, but because we have some special cases. Patch Tuesday includes security updates for 59 bugs, two of which are known to be actively exploited. The Cybersecurity & Infrastructure Security Agency CISA has...
The vulnerability of the Azure HDInsights data analytics service, related to insufficient access control, allows attackers to escalate their privileges.
The vulnerability of the Azure HDInsight data analytics service is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges through a specially crafted request...
