Fedora 38 : community-mysql (2023-9ff7fd16a0)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9ff7fd16a0 advisory. MySQL 8.0.35 Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-35.html Tenable has extracted the preceding description block directly...

Fedora 39 : community-mysql (2023-e7aa13efc5)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e7aa13efc5 advisory. MySQL 8.0.35 Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-35.html Tenable has extracted the preceding description block directly...

CVE-2023-29974

An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements...

PT-2023-22499 · Unknown · Pfsense Ce

Name of the Vulnerable Software and Affected Versions: Pfsense CE version 2.6.0 Description: An issue in Pfsense CE allows attackers to compromise user accounts due to weak password requirements. Recommendations: For Pfsense CE version 2.6.0, consider strengthening password requirements to preven...

Fedora 39 : community-mysql (2023-9ccff0b1b7)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9ccff0b1b7 advisory. MySQL 8.0.34 Release notes: https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-34.html Tenable has extracted the preceding description block...

UBUNTU-CVE-2023-3246

An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1 which allows an attackers to block Sidekiq job processor...

CISA Published When to Issue VEX Information

Today, CISA published When to Issue Vulnerability Exploitability eXchange VEX Information, developed by a community of industry and government experts with the goal to offer some guidance and structure for the software security world, including the large and growing global SBOM community. This...

CVE-2023-5831

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this...

PT-2023-32363 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.0 through 16.3.5 GitLab CE/EE versions 16.4 through 16.4.1 GitLab CE/EE versions 16.5.0 Description: An issue has been discovered in GitLab CE/EE which may unintentionally disclose GitLab version metadata to...

Metasploit Weekly Wrap-Up

PTT for DCSync This week, community member smashery made an improvement to the windowssecretsdump module to enable it to dump domain hashes using the DCSync method after having authenticated with a Kerberos ticket. Now, if a user has a valid Kerberos ticket for a privileged account, they can run...

[SECURITY] Fedora 39 Update: rt-5.0.5-2.fc39

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitted by a community of users...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Enterprise Edition EE and Community Edition CE. A malicious party could exploit vulnerabilities to bypass command measures, gain access to system data or cause a denial-of-service cause. Also included in this update are updates to several Third-party...

enterprisecommunity.org Cross Site Scripting vulnerability OBB-3770970

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 38 Update: rt-5.0.5-1.fc38

RT is an enterprise-grade ticketing system which enables a group of people to intelligently and efficiently manage tasks, issues, and requests submitted by a community of users...

Netgate pfSense CE Security Vulnerability

Netgate pfSense CE is a free and open source FreeBSD-based firewall and router software. A security vulnerability exists in Netgate pfSense CE version 2.6.0, which stems from the vulnerability to receive an unrate-limited attack that allows an attacker to create multiple malicious users in the...

Facad1ng - The Ultimate URL Masking Tool - An Open-Source URL Masking Tool Designed To Help You Hide Phishing URLs And Make Them Look Legit Using Social Engineering Techniques

Facad1ng is an open-source URL masking tool designed to help you Hide Phishing URLs and make them look legit using social engineering techniques. Your phishing link: https://example.com/whatever Give any custom URL: gmail.com Phishing keyword: anything-u-want Output:...

A Powerful Tool US Spies Misused to Stalk Women Faces Its Potential Demise

Though often viewed as the “crown jewel” of the US intelligence community, fresh reports of abuse by NSA employees and chaos in the US Congress put the tool's future in jeopardy...

[SECURITY] Fedora 37 Update: fbthrift-2023.10.16.00-1.fc37

Thrift is a serialization and RPC framework for service communication. Thrift enables these features in all major languages, and there is strong support for C++, Python, Hack, and Java. Most services at Facebook are written using Thri ft for RPC, and some storage systems use Thrift for serializin...

Stable Channel Update for Desktop

The Stable channel has been updated to 118.0.5993.117 for Mac and Linux and 118.0.5993.117/.118 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. The Extended Stable channel has been updated to 118.0.5993.117 for Mac and...

CVE-2023-37636

A stored cross-site scripting XSS vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket...