CVE-2023-29163 BIG-IP UDP Profile vulnerability

When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-24594 BIG-IP TMM SSL vulnerability

When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-22372 BIG-IP Edge Client for Windows and Mac OS vulnerability

In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Google Introduces Passwordless Secure Sign-In with Passkeys for Google Accounts

Almost five months after Google added support for passkeys to its Chrome browser, the tech giant has begun rolling out the passwordless solution across Google Accounts on all platforms. Passkeys, backed by the FIDO Alliance, are a more secure way to sign in to apps and websites without having to...

Google Authenticator WILL get end-to-end encryption. Eventually.

Following criticism, Google has decided to bring end-to-end encryption E2EE to its Google Authenticator cloud backups. The search giant recently introduced a feature that allows users back up two-factor authentication 2FA tokens to the cloud, but the lack of encryption caused some commentators to...

PT-2023-2522 · Cisco · Cisco Ata 190 +1

Name of the Vulnerable Software and Affected Versions: Cisco SPA112 versions affected versions not specified Description: A vulnerability in the web-based management interface of Cisco SPA112 2-Port Phone Adapters could allow an unauthenticated, remote attacker to execute arbitrary code on an...

GLSA-202305-22 : ISC DHCP: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202305-22 ISC DHCP: Multiple Vulnerabilities - In ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16, ISC DHCP 4.4.0 - 4.4.2 Other branches of ISC DHCP i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series are beyond their...

PT-2023-9398 · Yealink · Yealink Meeting Server

Name of the Vulnerable Software and Affected Versions: Yealink Meeting Server versions prior to V26.0.0.67 Description: The issue is related to insufficient protection of service data, allowing a remote attacker to gain access to user authentication data. Specifically, attackers can obtain static...

CVE-2023-2297

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function...

A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.

...

Google Authenticator App Gets Cloud Backup Feature for TOTP Codes

Search giant Google on Monday unveiled a major update to its 12-year-old Authenticator app for Android and iOS with an account synchronization option that allows users to back up their time-based one-time passwords TOTPs to the cloud. "This change means users are better protected from lockout and...

PT-2023-9991 · Arc · Arc

Name of the Vulnerable Software and Affected Versions: ARC aka ARC2 through 2011-12-01 Description: The issue allows reflected XSS via the end point.php query parameter in an output=htmltab action. This can be exploited through the "/end point.php" API endpoint, specifically by manipulating the...

UK Threatens End-to-End Encryption

In an open letter, seven secure messaging apps--including Signal and WhatsApp--point out that the UKs Online Safety Bill could destroy end-to-end encryption: As currently drafted, the Bill could break end-to-end encryption,opening the door to routine, general and indiscriminate surveillance of...

novel-plus SQL injection vulnerability (CNVD-2023-32773)

novel-plus novel boutique-plus is a multi-end PC, WAP reading, functional original literature CMS system. novel-plus version 3.6.2 suffers from a SQL injection vulnerability, which originates from a problem with the file /news/list?limit=10&offset=0&order=desc, where the operation of the paramete...

CVE-2023-23938

CVE-2023-23938 describes a cross-site scripting (XSS) vulnerability in Tuleap. Affected: Tuleap Community Edition and related builds prior to version 14.5.99.4. The issue arises when the name of a color used for values in a tracker’s select box is reflected in the tracker administration page, ena...

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Description There is a taint path can store payload into the database. visit http://127.0.0.1/corebos-master/index.php?action=PickList&module=PickList and click Add Item, the Add new entries here: can be tainted. Although there has a front limitation, but we can bypass it by modifying the request...

D-Link DAP-1320 < 1.21b05 RCE Vulnerability

D-Link DAP-1320 devices are prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Weak Encryption

nextcloud-desktop is vulnerable to Weak Encryption. The vulnerability allows a malicious server administrator to recover and modify contents of end-to-end encrypted files...

Weak Encryption

nextcloud-desktop is vulnerable to Weak Encryption. The vulnerability allows a malicious server administrator to recover and modify contents of end-to-end encrypted files...

tpm: TCG TPM2.0 implementations vulnerable to memory corruption

An out-of-bounds write vulnerability was found in the TPM 2.0's Module Library, which allows the writing of 2-byte data after the end of the TPM command. This flaw may lead to a denial of service or arbitrary code execution within the libtpms scope...