Tenable Security Center Multiple Vulnerabilities (TNS-2023-35)

According to its self-reported version, the Tenable Security Center running on the remote host is affected by multiple vulnerabilities as referenced in the TNS-2023-35 advisory. - Security Center leverages third-party software to help provide underlying functionality. One of the third- party...

Important: Red Hat Security Advisory: plexus-archiver security update

An update for plexus-archiver is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Malicious code in zoo-web-components-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a033ba4e84e9b29f5eb20d41c448241b24f20fb48b6ad382babb24543441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8508 Malicious code in zoo-web-components-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a033ba4e84e9b29f5eb20d41c448241b24f20fb48b6ad382babb24543441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the notification mechanism of the operating system “Avrora”, which allows a perpetrator to increase their privileges

The vulnerability of the “Avora” operating system’s notification mechanism is related to deficiencies in permission control for applications that send notifications. Exploiting this vulnerability allows attackers to execute privileged requests to system components, which can lead to violations of...

Design/Logic Flaw

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...

CVE-2023-46130

CVE-2023-46130 affects Discourse prior to 3.1.3 (stable) and 3.2.0.beta3 (beta/tests-passed) where certain theme components (svgbob and mermaid) allow SVGs with unlimited height attributes, potentially impacting the availability of subsequent replies in a topic. The issue is patched in Discourse ...

CVE-2023-46130 Bypassing height value allowed in some theme components

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...

CVE-2023-46130 Bypassing height value allowed in some theme components

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...

CVE-2023-46130 Bypassing height value allowed in some theme components

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the stable branch and version 3.2.0.beta3 of the beta and tests-passed branches, some theme components allow users to add svgs with unlimited height attributes, and this can affect the availability of...

MAL-2023-8503 Malicious code in @atea/common-design-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2329fd9b04f0c2f8d8db0bf754737afd91b53c559c6dfa3aaf3c1f337323f9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Symfony Security Vulnerabilities

Symfony is a PHP framework for web and console applications and a set of reusable PHP components from Symfony, Inc. A security vulnerability exists in Symfony that stems from improper input filtering...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

CVE-2023-5079

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

Input validation

Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure...

kernel: Linux kernel: Denial of Service in scsi_ses due to enclosure with no components

A flaw was found in the Linux kernel's scsi: ses driver. A local attacker could trigger a kernel crash oops by attempting to manage a SCSI enclosure that reports having no components. This could lead to a Denial of Service DoS on the affected system...

Malicious code in cms-flypage-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d208b1be216f60a6b0ef3db92b8e634aa6d55021f159ba22f9f5b57c3bfebf11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8454 Malicious code in cms-flypage-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d208b1be216f60a6b0ef3db92b8e634aa6d55021f159ba22f9f5b57c3bfebf11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Pixel Update Bulletin—November 2023Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Update Bulletin contains details of security vulnerabilities and functional improvements affecting supported Pixel devices Google devices. For Google devices, security patch levels of 2023-11-01 or later address all issues in this bulletin and all issues in the November 2023 Android...

Vault, Consul, and Boundary Affected By HTTP/2 “Rapid Reset” Denial of Service Vulnerability (CVE-2023-44487)

Summary A denial of service vulnerability was identified in many implementations of the HTTP/2 protocol CVE-2023-44487, including Go’s implementation CVE-2023-39325. This was addressed by updating vulnerable components for the affected HashiCorp products listed above. Background In October 2023, ...