CVE-2023-45688 Information leak via path traversal in Titan MFT and Titan SFTP servers

Lack of sufficient path validation in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to get the size of an arbitrary file on the filesystem using path traversal in the ftp "SIZE" command...

CVE-2023-45686 Arbitrary file write via WebDAV path traversal in Titan MFT and Titan SFTP servers

Insufficient path validation when writing a file via WebDAV in South River Technologies' Titan MFT and Titan SFTP servers on Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

CVE-2023-45685 Arbitrary file write via "zip slip" in Titan MFT and Titan SFTP servers

Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

CVE-2023-45685 Arbitrary file write via "zip slip" in Titan MFT and Titan SFTP servers

Insufficient path validation when extracting a zip archive in South River Technologies' Titan MFT and Titan SFTP servers on Windows and Linux allows an authenticated attacker to write a file to any location on the filesystem via path traversal...

SUSE CVE-2023-41914

SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files...

SUSE SLED15: cluster-md-kmp-64kb / cluster-md-kmp-default / dlm-kmp-64kb / etc (SUSE-SU-2023:4071-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4071-1 advisory. The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security and bugfixes. Th...

SUSE-SU-2023:4072-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-4563: Fixed an use-after-free flaw in the nftables sub-component. This vulnerability could allow a local attacker to crash the system or lead to a kerne...

Node.js path traversal vulnerability

Node.js is an open source, cross-platform JavaScript runtime environment. A path traversal vulnerability exists in Node.js version 20.x, which stems from the node:fs function allowing paths to be specified as strings or Uint8Array objects...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2023-3000)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2023-2974)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4058-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-39192: Fixed an out of bounds read in the netfilter bsc1215858. - CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem bsc1215860. -...

A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.

...

CVE-2023-36605

Windows Named Pipe Filesystem Elevation of Privilege Vulnerability...

CVE-2023-36605

Windows Named Pipe Filesystem Elevation of Privilege Vulnerability...

CVE-2023-36605

Technical details for CVE-2023-36605 are not publicly provided in the connected documents. The entry notes a Windows Named Pipe Filesystem Elevation of Privilege vulnerability, but no affected product versions, root cause, or remediation are documented here. Monitor for updates.

SUSE-SU-2023:4035-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2023-39194: Fixed an out of bounds read in the XFRM subsystem bsc1215861. - CVE-2023-39193: Fixed an out of bounds read in the xtables subsystem bsc121586...

SUSE-SU-2023:4030-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-4389: Fixed a reference counting issue in the Btrfs filesystem that could be exploited in order to leak internal kernel information or crash the system...

Windows Named Pipe Filesystem Elevation of Privilege Vulnerability

...

The reality of Apple watch pen testing

Introduction We were approached to do an Apple Watch application test. It seems this isnt a service offered by many companies including us, although we’ve done plenty of work on Android Wear before but also, little information exists online about attempts, experiences or if it’s even possible. So...

Huawei EulerOS: Security Advisory for qemu (EulerOS-SA-2023-2906)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...