Microsoft Secure Boot Bug

Microsoft is currently patching a zero-day Secure-Boot bug. The BlackLotus bootkit is the first-known real-world malware that can bypass Secure Boot protections, allowing for the execution of malicious code before your PC begins loading Windows and its many security protections. Secure Boot has...

crate has been renamed to `crypto_secretbox`

This crate has been forked/renamed from xsalsa20poly1305 to cryptosecretbox. The new repository location is at:...

qemu-kvm security update

6.1.1-6.el9 - Update changelog Karl Heubaum Orabug: 35343538 - ebpf: fix compatibility with libbpf 1.0+ Shreesh Adiga Orabug: 35268538 - ebpf: replace deprecated bpfprogramsetsocketfilter Haochen Tong Orabug: 35268538 - CVE-2023-1544 is not applicable to Oracle QEMU 6.1.1 Karl Heubaum Orabug:...

SUSE-EL-9-CLIENT-TOOLS-2023-2185 Security update for SUSE Manager Client Tools

This update fixes the following issues: prometheus-postgresexporter: - Security issues fixed: CVE-2022-46146: Fix authentication bypass via cache poisoning bsc1208060 - Other non-security issues fixed: Adapt the systemd service security configuration to be able to start it on for Red Hat Linux...

Python Charmers Future Version Compatibility Program Regular Expression DoS

The vulnerability of the Python Charmers Future version compatibility program is related to incorrect input validation during the processing of Set-Cookie headers. Exploiting this vulnerability allows a remote attacker to send a specially crafted HTTP request to the application and execute a...

SUSE: Security Advisory (SUSE-SU-2023:2150-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:2150-1 Security update for shim

This update for shim fixes the following issues: - Updated shim signature after shim 15.7 be signed back: signature-sles.x8664.asc, signature-sles.aarch64.asc bsc1198458 - Add POSTPROCESSPEFLAGS=-N to the build command in shim.spec to disable the NX compatibility flag when using post-process-pe...

UBUNTU-CVE-2023-2283

A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in thepkiverifydatasignature function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the retu...

SUSE: Security Advisory (SUSE-SU-2023:2086-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-1477

Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Extension: before 7.10.2, before 8.0.3...

GHSA-329J-JFVR-RHR6 Apache Spark vulnerable to Improper Privilege Management

In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a proxy-user to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the...

SUSE: Security Advisory (SUSE-SU-2023:1863-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-22769 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.8.3 Description: The proposal creation entrypoint propose in GovernorCompatibilityBravo allows the creation of proposals with a signatures array shorter than the calldatas array. This causes the...

Security Bulletin: Vulnerability in lighttpd affects IBM Integrated Management Module (IMM) (CVE-2015-3200)

Summary IBM Integrated Management Module IMM has addressed the following vulnerability in lighttpd. Vulnerability Details Summary IBM Integrated Management Module IMM has addressed the following vulnerability in lighttpd. Vulnerability Details: CVE-ID: CVE-2015-3200 Description: lighttpd could...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM BladeCenter Switches (CVE-2015-7575)

Summary The MD5 "SLOTH" vulnerability on TLS 1.2 affects IBM BladeCenter Switches. Vulnerability Details Summary The MD5 "SLOTH" vulnerability on TLS 1.2 affects IBM BladeCenter Switches. Vulnerability Details CVE-ID: CVE-2015-7575 Description: The TLS protocol could allow weaker than expected...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integrated Management Module (IMM) (CVE-2016-0705 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799)

Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project. OpenSSL is used by IBM Integrated Management Module IMM which has addressed the applicable CVEs. Vulnerability Details Summary OpenSSL vulnerabilities were disclosed on March 1, 2016 by the OpenSSL Project...

StoreOnce and Veeam Immutability Compatibility

Challenge A backup job that targets an HPE StoreOnce Catalyst repository may display either of the following messages: In Veeam Backup & Replication 12.0, the job will fail and display the error: OSCLTERRIMMUTABLEEPOCHREQUESTEXCEEDSMAXIMUM. Err: -1817 In Veeam Backup & Replication 12.1, the job...

PT-2023-19582 · Wp Engine · Wp Engine Php Compatibility Checker

Name of the Vulnerable Software and Affected Versions: WP Engine PHP Compatibility Checker plugin versions = 1.5.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions...

Python Exec, Command Shell, Reverse SCTP (via python)

Execute a Python payload from a command. Creates an interactive shell via Python, encodes with base64 by design. Compatible with Python 2.6-2.7 and 3.4+. Module Options msf use payload/cmd/windows/python/shellreversesctp msf payloadshellreversesctp show actions ...actions... msf...

SUSE-SU-2023:1814-1 Security update for podman

This update for podman fixes the following issues: Update to version 4.4.4: libpod: always use direct mapping macos pkginstaller: do not fail when podman-mac-helper fails podman-mac-helper: install: do not error if already installed - podman.spec: Bump required version for libcontainers-common...