KLA50318 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of...

Forrester names Microsoft a Leader in the 2023 Enterprise Email Security Wave

In today’s rapidly evolving connected workplace, where hybrid and remote work are increasingly the norm, workplace productivity and communications tools like email and chat applications are more important than ever. However, cyberthreats continue to evolve with increasing capabilities and...

Ubuntu 22.04 LTS / 23.04 : GlusterFS vulnerability (USN-6157-1)

The remote Ubuntu 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6157-1 advisory. Tao Lyu discovered that GlusterFS did not properly handle certain event notifications. An attacker could possibly use this issue to cause a denial of...

Fedora 37 : less (2023-71442d7613)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-71442d7613 advisory. Security fix for CVE-2022-46663 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Metasploit Weekly Wrap-Up

MOVEit It has been a busy few weeks in the security space; the MOVEit vulnerability filling our news feeds with dancing lemurs and a Barracuda vulnerability that has us all wondering how many shredders out there can handle a 1U appliance. Despite those very worthwhile distractions, Metasploit has...

Fedora 38 : dbus (2023-c95d3f825f)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c95d3f825f advisory. Update to 1.14.8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-194)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-194 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Tenable has...

Google Chrome < 114.0.5735.106 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 114.0.5735.106. It is, therefore, affected by a vulnerability as referenced in the 202306stable-channel-update-for-desktop advisory. - Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacke...

Threat Roundup for May 26 to June 2

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 26 and June 2. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

CBL Mariner 2.0 Security Update: vim (CVE-2023-2609)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-2609 advisory. - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531. CVE-2023-2609 Note that Nessus has not...

CBL Mariner 2.0 Security Update: vim (CVE-2023-2610)

The version of vim installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-2610 advisory. - Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532. CVE-2023-2610 Note that Nessus ha...

Citrix StoreFront Server XXE (CTX477616)

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 3.12.4000, and 7.6 LTSR before CU8 3.0.8000 allows XXE attacks. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc...

F5 Networks BIG-IP : bzip2 vulnerability (K68713584)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K68713584 advisory. BZ2decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : Avahi vulnerability (USN-6129-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6129-1 advisory. It was discovered that Avahi incorrectly handled certain DBus messages. A local attacker could possibly use this issue to cause Avahi to crash...

Fedora 38 : python3.8 (2023-d8b0003ecd)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d8b0003ecd advisory. Fix for CVE-2023-24329 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Brute-Forcing a Fingerprint Reader

Its neither hard nor expensive: Unlike password authentication, which requires a direct match between what is inputted and whats stored in a database, fingerprint authentication determines a match using a reference threshold. As a result, a successful fingerprint brute-force attack requires only...

Fedora 38 : python2.7 (2023-96aa33f0d3)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-96aa33f0d3 advisory. Fix for CVE-2023-24329 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Fedora 37 : python3.11 (2023-63c69aa712)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-63c69aa712 advisory. Fix for CVE-2023-24329 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

CISA Releases One Industrial Control Systems Advisory

CISA released one Industrial Control Systems ICS advisory on May 25, 2023. This advisory provides timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-145-01 Moxa MXsecurity Series CISA encourages users and administrators to review the newly...

KLA49330 Multiple vulnerabilities in LibreOffice

Multiple vulnerabilities were found in LibreOffice. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Improper Access Control vulnerability in IFrame can be exploited to bypass security...