PT-2023-30764

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 23.11.0 Description The issue is a cross-site scripting XSS vulnerability in the device group popups. This occurs when the application does not properly sanitize inputs, allowing an attacker to execute malicious...

tang security and bug fix update

7-8 - Set correct user/group tang/tang in tangd-keygen Resolves: rhbz2188743 7-7 - Fix race condition when creating/rotating keys Resolves: rhbz2182410 Resolves: CVE-2023-1672...

Explanation of Delivery Group power management for single session

Explain the detail difference between"Machines to be powered on" in delivery group and "PeakBufferSizePercent" in DDC powershell SDK, when control the power management for pool random delivery groupor unassigned machines...

CVE-2023-48295: Improper Neutralization of Input During Web Page Generation

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting XSS vulnerability in the device group popups. This issue has been addressed in commit...

FBI and CISA Release Advisory on Scattered Spider Group

Today, the Federal Bureau of Investigation FBI and the Cybersecurity and Infrastructure Security Agency CISA released a joint Cybersecurity Advisory CSA on Scattered Spider—a cybercriminal group targeting commercial facilities sectors and subsectors. The advisory provides tactics, techniques, and...

'Use server time zone' setting not getting applied through Studio policy

PVS Target Device - Use server time zone policy is not getting applied on server 2019 VDA. Citrix Policy "Use local time of client" is Configured. Value set to use time zone of user session server time zone. Registry key: HKEYLOCALMACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services...

Oracle Linux 9 : tpm2-tss (ELSA-2023-6685)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6685 advisory. 3.2.2-2 - Remove misapplied license Resolves: rhbz2160307 3.2.2-1 - Rebase to 3.2.2 - Use systemd-sysusers to create user Resolves: CVE-2023-22745 Resolves:...

Low: Red Hat Security Advisory: shadow-utils security and bug fix update

An update for shadow-utils is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

containerd: Supplementary groups are not set up properly

A flaw was found in containerd, where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some...

Low: shadow-utils security and bug fix update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fixes: shadow-utils: possible password leak during passwd1 change CVE-2023-4641 For more details about the security...

VulnCheck KEV: CVE-2022-39960

The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a plugins/servlet/groupexportforjira/admin/ URI...

matio:matio_fuzzer: Heap-buffer-overflow in H5MM_strdup

Project: git://git.code.sf.net/p/matio/matio https://github.com/tbeu/matio.git Detailed Report: https://oss-fuzz.com/testcase?key=5449537673887744 Project: matio Fuzzing Engine: afl Fuzz Target: matiofuzzer Job Type: aflasanmatio Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash...

Microsoft Warns of Fake Skills Assessment Portals Targeting IT Job Seekers

A sub-cluster within the infamous Lazarus Group has established new infrastructure that impersonates skills assessment portals as part of its social engineering campaigns. Microsoft attributed the activity to a threat actor it calls Sapphire Sleet, describing it as a "shift in the persistent...

CryptoChat - Beyond Secure Messaging

Welcome to CryptChat - where conversations remain truly private. Built on the robust Python ecosystem, our application ensures that every word you send is wrapped in layers of encryption. Whether you're discussing sensitive business details or sharing personal stories, CryptChat provides the...

Exploit for Out-of-bounds Write in Google Chrome

level 1: craft.c - bad.webp bash exist: docker 813b6b757...

Glib Heap Buffer Overflow DoS

The vulnerability of the goptiongroupaddEntries function in the Glib library is related to integer overflow. Exploiting this vulnerability could allow an attacker to access confidential data, compromise its integrity, and even cause service failures...

Design/Logic Flaw

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 and other vehicles of the VW Group with the same hardware and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls...

CVE-2023-6073 DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU

Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 and other vehicles of the VW Group with the same hardware and spoof volume setting commands to irreversibly turn on audio volume to maximum via REST API calls...

CVE-2023-6073

CVE-2023-6073 affects the Volkswagen ID.3 ICAS 3 IVI ECU. Affected component: ICAS 3 IVI ECU in VW Group vehicles with the same hardware. Description provided across sources states that an attacker can perform a Denial of Service to crash the ICAS 3 IVI ECU and spoof REST API volume commands to i...

Iran-Linked Imperial Kitten Cyber Group Targeting Middle East's Tech Sectors

A group with links to Iran targeted transportation, logistics, and technology sectors in the Middle East, including Israel, in October 2023 amid a surge in Iranian cyber activity since the onset of the Israel-Hamas war. The attacks have been attributed by CrowdStrike to a threat actor it tracks...