CVSS v4 Is Now Live and What You Need To Know About It

On November 1st, 2023, the Common Vulnerability Scoring System version 4 CVSS v4 was officially launched in General Availability GA following a period of public preview and feedback collection. This launch was orchestrated by the Forum of Incident Response and Security Teams FIRST, marking a...

Security Bulletin: IBM Storage Ceph is vulnerable via Exposure of Sensitive Information to an Unauthorized Actork in Golang (CVE-2022-32148)

Summary Golang is used by IBM Storage Ceph as part of RGW and in assorted other locations. CVE-2022-32148 Vulnerability Details CVEID: CVE-2022-32148 DESCRIPTION: Golang Go could allow a remote attacker to obtain sensitive information, caused by improper exposure of client IP addresses in net/htt...

Security Bulletin: "Unrestricted Internet Access/Outbound Connections" affects IBM CICS TX Standard and IBM CICS TX Advanced

Summary "Unrestricted Internet Access/Outbound Connections" affects IBM CICS TX Standard and IBM CICS TX Advanced. IBM CICS TX Standard and IBM CICS TX Advanced have addressed the applicable vulnerability. Vulnerability Details CVEID: CVE-2023-43018 DESCRIPTION: IBM CICS TX performs an operation ...

Security Bulletin: "Cross Site Request Forgery" affects IBM CICS TX Advanced and IBM CICS TX Standard

Summary "Cross Site Request Forgery" affects IBM CICS TX Advanced and IBM CICS TX Standard. IBM CICS TX Advanced and IBM CICS TX Standard have addressed the applicable vulnerability. Vulnerability Details CVEID: CVE-2023-42027 DESCRIPTION: IBM CICS TX is vulnerable to cross-site request forgery...

SUSE CVE-2021-3480

A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability...

VMware Workspace ONE UEM console updates address an open redirect vulnerability (CVE-2023-20886)

3. Advisory Details VMware Workspace ONE UEM console contains an open redirect vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.8...

Fedora: Security Advisory for golang (FEDORA-2023-4bf641255e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

homeassistant-stubs (2022.9.6), mqtt-hass-base (>=4.0.9, <=4.0.10) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.9.6)

homeassistant PYPI version 2022.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.9.6 - mqtt-hass-base =4.0.9, =4.0.10 - pytest-homeassistant-custom-component 0.11.25 Source cves:...

homeassistant-stubs (2022.8.7), mqtt-hass-base (>=4.0.0, <=4.0.7) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.8.7)

homeassistant PYPI version 2022.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.8.7 - mqtt-hass-base =4.0.0, =4.0.7 - pytest-homeassistant-custom-component 0.11.12 Source cves:...

homeassistant-stubs (2022.11.5), hydroqc2mqtt (>=0.5.0, <=0.6.1) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.11.5)

homeassistant PYPI version 2022.11.5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.5 - hydroqc2mqtt =0.5.0, =0.6.1 - mqtt-hass-base 4.1.1 Source cves: CVE-2023-41893 Source advisory:...

homeassistant-stubs (2022.10.2), mqtt-hass-base (4.0.14) +1 more potentially affected by CVE-2023-41893 via homeassistant (2022.10.2)

homeassistant PYPI version 2022.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.10.2 - mqtt-hass-base 4.0.14 - pytest-homeassistant-custom-component 0.12.7 Source cves: CVE-2023-41893...

D-Link Router Code Execution

The vulnerability of the pppoebase.asp function in D-Link router microprogramming products such as DI-7003GV2, DI-7100G, DI-7100GV2, DI-7200G, DI-7200GV2, DI-7300G, and DI-7400G lies in the fact that the operation’s output escapes the buffer in memory. Exploiting this vulnerability allows a remot...

Microsoft Edge Service Information Disclosure

The vulnerability of Microsoft Edge based on Chromium is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

netify (>=0.1.1, <=0.2.0), odooku-odoo-account-invoicing (>=11.0.0, <=11.0.6) +36 more potentially affected by CVE-2023-46136 via werkzeug (0.11.11)

werkzeug PYPI version 0.11.11 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - netify =0.1.1, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0,...

canonicalwebteam-flask-base (>=0.3.3, <=0.9.3), flexget (>=2.21.21, <=3.1.104) +4 more potentially affected by CVE-2023-46136 via werkzeug (0.15.6)

werkzeug PYPI version 0.15.6 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - canonicalwebteam-flask-base =0.3.3, =2.21.21, =0.1.0a27, =0.1.0, =0.15.0, =0.2.0, =0.2.1 Source cves: CVE-2023-46136 Source advisory:...

rs-stellar-base (0.1.0), sep5 (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2023-46135 via stellar-strkey (>=0.0.6, <=0.0.7)

stellar-strkey CARGO version =0.0.6, =0.0.1, =0.1.1, =0.1.0, =0.1.5 Source cves: CVE-2023-46135 Source advisory: OSV:GHSA-5873-6FWQ-463F...

rs-stellar-base (0.1.0), sep5 (>=0.0.1, <=0.0.2) +2 more potentially affected by CVE-2023-46135 via stellar-strkey (>=0.0.6, <=0.0.7)

stellar-strkey CARGO version =0.0.6, =0.0.1, =0.1.1, =0.1.0, =0.1.5 Source cves: CVE-2023-46135 Source advisory: GHSA-5873-6FWQ-463F...

Denial Of Service (DoS)

next is vulnerable to Denial Of Service DoS. The vulnerability exists because the base-server.ts does not include a cache-control header. Consequently, empty prefetch responses might be cached by a Content Delivery Network CDN. This creates an opportunity for an attacker to potentially crash the...

Ubuntu: Security Advisory (USN-6448-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for folly (FEDORA-2023-17efd3f2cd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...