MGASA-2023-0354 Updated gstreamer packages fix many security vulnerabilities

Updated gstreamer packages fix many security issues see the references below. Apart from the listed CVEs, ZDI-CAN-22300 is also fixed...

Updated gstreamer packages fix many security vulnerabilities

Updated gstreamer packages fix many security issues see the references below. Apart from the listed CVEs, ZDI-CAN-22300 is also fixed...

CVE-2023-38126

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

Remote code execution

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

CVE-2023-38126 Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability

Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Softing edgeAggregator. Authentication is required to exploit this vulnerability. The specific fl...

CVE-2023-38126

Softing CVE-2023-38126 is a directory traversal leading to remote code execution in Softing edgeAggregator and edgeConnector. The vulnerability stems from insufficient validation of a user-supplied path when processing backup zip files, allowing an attacker with network access and admin privilege...

AlmaLinux 9 : gstreamer1-plugins-bad-free (ALSA-2023:7791)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:7791 advisory. - Fixes for GStreamer-SA-2023-0010 ZDI-CAN-22299 and GStreamer-SA-2023-0009 ZDI-CAN-22226 CVE-2023-44429 CVE-2023-44429 - MXF demuxer use-after-free...

RHEL 9 : gstreamer1-plugins-bad-free (RHSA-2023:7791)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7791 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package...

CVE-2023-47079 ZDI-CAN-22279: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Adobe Dimension versions 3.4.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victi...

Silverpeas Security Vulnerabilities

Silverpeas is an open source business collaboration platform. The platform includes applications for project management, blogs, forums and document management. A security vulnerability exists in Silverpeas Core version 6.3.1, which stems from the vulnerability of the Bin feature to corrupted acce...

CVE-2023-28896

Access to critical Unified Diagnostics Services UDS of the Modular Infotainment Platform 3 MIB3 infotainment is transmitted via Controller Area Network CAN bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III 3V3 -...

Design/Logic Flaw

Access to critical Unified Diagnostics Services UDS of the Modular Infotainment Platform 3 MIB3 infotainment is transmitted via Controller Area Network CAN bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III 3V3 -...

CVE-2023-28896 Weak encoding for password in UDS services

Access to critical Unified Diagnostics Services UDS of the Modular Infotainment Platform 3 MIB3 infotainment is transmitted via Controller Area Network CAN bus in a form that can be easily decoded by attackers with physical access to the vehicle. Vulnerability discovered on Škoda Superb III 3V3 -...

CVE-2023-28896

The CVE-2023-28896 entry describes a vulnerability in the Modular Infotainment Platform 3 (MIB3) UDS on Škoda Superb III (3V3) 2.0 TDI (2022). The issue allows an attacker with physical access to decode UDS data transmitted over the CAN bus, indicating weak or insufficient protection of the diagn...

PT-2023-22036 · Volkswagen · Modular Infotainment Platform 3

Name of the Vulnerable Software and Affected Versions: Modular Infotainment Platform 3 MIB3 affected versions not specified Description: Access to critical Unified Diagnostics Services UDS of the Modular Infotainment Platform 3 MIB3 infotainment is transmitted via Controller Area Network CAN bus ...

The vulnerability of the subsys/canbus/isotp/isotp.c file in the CAN-bus subsystem of the real-time operating system Zephyr allows a attacker to execute arbitrary code.

The vulnerability of the subsys/canbus/isotp/isotp.c file in the CAN-bus subsystem of the real-time operating system Zephyr relates to the possibility of buffer overflow based on a stack. Exploiting this vulnerability could allow an attacker, operating remotely, to execute arbitrary code...

CVE-2023-42501 Apache Superset: Unnecessary read permissions within the Gamma role

Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run superset init to reconstruct the Gamma role or remove canre...

CVE-2023-6248

The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connect...

CVE-2023-6248

The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connect...

Hardcoded credentials

The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code on any Syrus4 device connected to the cloud service. The MQTT server also leaks the location, video and diagnostic data from each connect...