CVE-2023-30990

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a remote attacker to execute CL commands as QUSER, caused by an exploitation of DDM architecture. IBM X-Force ID: 254036...

CVE-2023-36812 Remote Code Execution in OpenTSDB

OpenTSDB is a open source, distributed, scalable Time Series Database TSDB. OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. This issue has been patched in commit...

io.github.lsd-consulting:lsd-core (>=5.1.0, <=5.4.0), io.github.lsd-consulting:lsd-cucumber (>=4.1.0, <=4.1.1) +9 more potentially affected by CVE-2023-3432 via net.sourceforge.plantuml:plantuml-mit (>=1.2023.7, <=1.2023.8)

net.sourceforge.plantuml:plantuml-mit MAVEN version =1.2023.7, =5.1.0, =4.1.0, =4.1.0, =4.1.0, =3.1.0, =4.1.0, =0.0.2, =5.1.0, =1.3.12, =1.3.12, =1.3.12, =1.3.20 Source cves: CVE-2023-3432 Source advisory: OSV:GHSA-FF3M-68VJ-H86P...

io.github.lsd-consulting:lsd-core (>=5.1.0, <=5.4.0), io.github.lsd-consulting:lsd-cucumber (>=4.1.0, <=4.1.1) +9 more potentially affected by CVE-2023-3432 via net.sourceforge.plantuml:plantuml-mit (>=1.2023.7, <=1.2023.8)

net.sourceforge.plantuml:plantuml-mit MAVEN version =1.2023.7, =5.1.0, =4.1.0, =4.1.0, =4.1.0, =3.1.0, =4.1.0, =0.0.2, =5.1.0, =1.3.12, =1.3.12, =1.3.12, =1.3.20 Source cves: CVE-2023-3432 Source advisory: GHSA-FF3M-68VJ-H86P...

io.github.lsd-consulting:lsd-core (>=5.1.0, <=5.4.0), io.github.lsd-consulting:lsd-cucumber (>=4.1.0, <=4.1.1) +9 more potentially affected by CVE-2023-3431 via net.sourceforge.plantuml:plantuml-mit (>=1.2023.7, <=1.2023.8)

net.sourceforge.plantuml:plantuml-mit MAVEN version =1.2023.7, =5.1.0, =4.1.0, =4.1.0, =4.1.0, =3.1.0, =4.1.0, =0.0.2, =5.1.0, =1.3.12, =1.3.12, =1.3.12, =1.3.20 Source cves: CVE-2023-3431 Source advisory: MEND:CVE-2023-3431...

New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks

A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 AX1800 Wi-Fi routers to rope the devices into a distributed denial-of-service DDoS botnet. Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work ...

From Cryptojacking to DDoS Attacks: Diicot Expands Tactics with Cayosin Botnet

Cybersecurity researchers have discovered previously undocumented payloads associated with a Romanian threat actor named Diicot , revealing its potential for launching distributed denial-of-service DDoS attacks. "The Diicot name is significant, as it's also the name of the Romanian organized crim...

Schneider Electric EcoStruxure Foxboro DCS buffer error vulnerability

The Schneider Electric EcoStruxure Foxboro DCS is an innovative fault-tolerant, highly available control component from Schneider Electric, France. A buffer overflow vulnerability exists in Schneider Electric EcoStruxure Foxboro DCS Control Core Services, which originates from a boundary error wh...

DCE/RPC Process Callaway Code Execution

The vulnerability of the DCE/RPC process callouts system for MacOS operating systems relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Rockwell Automation ArmorStart ST XSS

The vulnerability of the microprogramming software for Rockwell Automation’s ArmorStart ST distributed controllers is related to deficiencies in the validation of user-input data. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting XSS attacks remotely...

Important: Red Hat Security Advisory: git security update

An update for git is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Important: Red Hat Security Advisory: git security update

An update for git is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Important: Red Hat Security Advisory: git security update

An update for git is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Important: Red Hat Security Advisory: git security update

An update for git is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

kernel: fs: dlm: fix invalid derefence of sb_lvbptr

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix invalid derefence of sblvbptr I experience issues when putting a lkbsb on the stack and have sblvbptr field to a dangled pointer while not using DLMLKFVALBLK. It will crash with the following kernel message, the...

[SECURITY] Fedora 36 Update: git-2.40.1-1.fc36

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The git rpm installs common set of tools which are usually using with small amount of dependencies. To install all git packages,...

CVE-2023-32082

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...

UBUNTU-CVE-2023-32082

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...

Code injection

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names not value associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limit...

CVE-2023-32082

CVE-2023-32082 affects etcd. The LeaseTimeToLive API (with Keys=true) could expose key names to users who lack read permission, impacting RBAC-enabled clusters. This vulnerability is fixed in etcd versions 3.4.26 and 3.5.9; upgrade to a fixed release (or newer) to remediate. No workarounds are do...