GHSA-Q3QX-C6G2-7PW2 aiohttp's ClientSession is vulnerable to CRLF injection via version

Summary Improper validation make it possible for an attacker to modify the HTTP request e.g. to insert a new header or even create a new HTTP request if the attacker controls the HTTP version. Details The vulnerability only occurs if the attacker can control the HTTP version of the request...

Authorization

Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL stateme...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Apache HTTP Server vulnerabilities (USN-6506-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6506-1 advisory. David Shoon discovered that the Apache HTTP Server modmacro module incorrectly handled certain memory operations. A remote...

Unable To Launch VDI "Unknown Client Error 1110"

Citrix Workspace App connects to VDI over a VPN, failing with the following error. Socket error 10057 Unknown client error 1110...

The vulnerability of the nf_conntrack_dccp_packet() function in the net/netfilter/nf_conntrack_proto_dccp.c module of the Linux operating system allows a hacker to gain access to protected information.

The vulnerability of the nfconntrackdccppacket function in the net/netfilter/nfconntrackprotodccp.c module of the Linux kernel is related to the escape of allocated memory from the protected area. Exploiting this vulnerability can allow an attacker to gain access to protected information...

Malicious code in vehicle-data-store-connection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4c6802f89906e18e5e41df18e11e76065ac56c4b4c2c8352c4d6a6c4bc8b43ff The OpenSSF Package Analysis project identified 'vehicle-data-store-connection' @ 4.0.0 npm as malicious. It is considered malicious because: -...

MAL-2023-8528 Malicious code in vehicle-data-store-connection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4c6802f89906e18e5e41df18e11e76065ac56c4b4c2c8352c4d6a6c4bc8b43ff The OpenSSF Package Analysis project identified 'vehicle-data-store-connection' @ 4.0.0 npm as malicious. It is considered malicious because: -...

How to migrate to new vcenter host connection

Change Citrix to the new vCenter server...

Oracle Linux 9 : avahi (ELSA-2023-6707)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6707 advisory. - Fix CVE-2023-1981 2186689 - Fix CVE-2021-3502 1949949 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Amazon Linux 2023 : httpd, httpd-core, httpd-devel (ALAS2023-2023-433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-433 advisory. Out-of-bounds Read vulnerability in modmacro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. CVE-2023-31122 A flaw was found in httpd. This flaw allows an attacker...

kernel: hash collisions in the IPv6 connection lookup table

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6...

kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved for HTCCTRLRSVDSVC and should not be...

kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c

A vulnerability was found in the Linux Kernel in the l2capconndel in net/bluetooth/l2capcore.c function in the Bluetooth component. This issue leads to a use-after-free problem...

OPENSUSE-SU-2023:0369-1 Security update for connman

This update for connman fixes the following issues: Update to 1.42 Fix issue with iwd and signal strength calculation. Fix issue with iwd and handling service removal. Fix issue with iwd and handling new connections. Fix issue with handling default online check URL. Fix issue with handling...

CVE-2023-46601

A vulnerability has been identified in COMOS All versions. The affected application lacks proper access controls in making the SQLServer connection. This could allow an attacker to query the database directly to access information that the user should not have access to...

SUSE-SU-2023:4071-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-39194: Fixed a flaw in the processing of state filters which could allow a local attackers to disclose sensitive information. bsc1215861 - CVE-2023-3919...

GHSA-XQ59-7JF3-RJC6 piccolo SQL Injection via named transaction savepoints

Summary The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection as user provided input is passed directly to connection.execute... via f-strings. Details An excerpt of the Postgres savepoint handling: python async def savepointself, name:...

curl security update

7.76.1-26 - unify the upload/method handling CVE-2023-28322 - fix host name wildcard checking CVE-2023-28321 7.76.1-25 - adapt the fix of CVE-2023-27535 for RHEL 9 curl 7.76.1-24 - fix SSH connection too eager reuse still CVE-2023-27538 - fix GSS delegation too eager connection re-use...

Windows Gather PL/SQL Developer Connection Credentials

This module can decrypt the histories and connection credentials of PL/SQL Developer, and passwords are available if the user chooses to remember. Module Options msf use post/windows/gather/credentials/plsqldeveloper msf postplsqldeveloper show actions ...actions... msf postplsqldeveloper set...

PT-2023-8666 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS affected versions not specified Description: The issue is related to an improper verification vulnerability in the GlobalProtect gateway feature of the software. This vulnerability allows a malicious user with stolen...