Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Remote code execution User rights Access to sensitive...

PT-2023-5062 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient input validation in the Internet Connection Sharing ICS function of the Windows operating system. This can be exploited by a remote attacker to execute...

PT-2023-5095 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient protection of service data in the implementation of the TCP/IP protocol in Windows operating systems. This can allow an attacker to gain unauthorized...

[SECURITY] [DSA 5495-1] frr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5495-1 [email protected] https://www.debian.org/security/ Aron Xu September 11, 2023 https://www.debian.org/security/faq -...

PT-2023-23104 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 4.0 through 4.4.2 IBM Aspera Faspex versions 5.0 through 5.0.5 Description: The issue allows a malicious actor to bypass IP whitelist restrictions using a specially crafted HTTP request. Recommendations: For IBM...

The vulnerability of the AtlasVPN client, related to the execution of functions from an unreliable controlled area, allows a hacker to obtain user IP addresses.

The vulnerability of the AtlasVPN client relates to the execution of functions from an untrusted controlled area. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain user IP addresses...

CVE-2023-20193

A vulnerability in the Embedded Service Router ESR of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arbitrary files on the underlying operating system and escalate their privileges to root. To exploit this vulnerability, an attacker must have valid...

FreeWorld ransomware attacks MSSQL—get your databases off the internet

When we think of ransomware and brute force password guessing attacks, we normally think of RDP, but recent research from Securonix reminds us that anything secured with a password and exposed to the internet is of interest to cybercriminals. Microsoft's Remote Desktop Protocol has been a favouri...

Internet Reservation Module Booking Engine Code Issue Vulnerability

Internet Reservation Module Booking Engine is a booking platform. A code issue vulnerability exists in Internet Reservation Module Booking Engine. An attacker could use this vulnerability to upload arbitrary content, such as a web shell component, to a SQL database and execute it with system...

Internet Reservation Module Booking Engine Trust Management Issue Vulnerability

Internet Reservation Module Booking Engine is a booking platform. Internet Reservation Module Booking Engine has a trust management issue vulnerability that stems from...

Internet Reservation Module Booking Engine Trust Management Issue Vulnerability

Internet Reservation Module Booking Engine is a reservation platform. A trust management issue vulnerability exists in Internet Reservation Module Booking Engine, which arises from the use of hard-coded API keys...

engine Trust Management Gaps

Internet Reservation Module Booking Engine is a booking platform. A trust management issue vulnerability exists in IRM Next Generation booking engine, which arises from the use of HMAC tokens to authenticate requests, but these tokens are exposed in JavaScript files loaded by the client...

CVE-2023-4809

In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a...

SUSE SLED15: busybox / busybox-adduser / busybox-attr / busybox-bc / etc (SUSE-SU-2023:3529-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3529-1 advisory. - CVE-2022-48174: Fixed stack overflow vulnerability. bsc1214538 Tenable has extracted the preceding...

FreeBSD Security Vulnerabilities

FreeBSD is a set of Unix-like operating systems from the FreeBSD Foundation. FreeBSD suffers from a security vulnerability that stems from the fact that IPv6 fragments may bypass firewall rules written on the assumption that all fragments have been reassembled and are therefore forwarded or...

kernel: ipvlan: out-of-bounds write caused by unclear skb->cb

A flaw was found in the IPVLAN network driver in the Linux kernel. This issue is caused by missing skb-cb initialization in ipoptionsecho and can lead to an out-of-bounds write stack overflow. This may allow a local user to cause a denial of service or potentially achieve local privilege escalati...

Bookreen Code Issues Vulnerabilities

Bookreen is a workspace scheduling software from Bookreen Turkey. It allows every location bookable via IoT devices to create maximum efficiency and satisfaction. A code issue vulnerability exists in Bookreen versions prior to 3.0.0, which stems from the presence of an unrestricted upload...

Internet Radio auna IR-160 SE UIProto DoS / XSS / Missing Authentication

The internet radio device auna IR-160 SE has multiple vulnerabilities. It uses the firmware UIProto, different versions of which can also be found in many other radios. 1. The firmware offers a rudimentary web API that can be reached on the local network on port 80. This API is completely...

Open Automation Software OAS Platform Security Feature Issue Vulnerability

Open Automation Software OAS Platform is an Industrial Internet of Things IoT suite from US-based Open Automation Software, Inc. It is designed to help organizations connect data sources to the OAS Platform. A security signature issue vulnerability exists in Open Automation Software OAS Platform...

CVE-2023-4279

This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic...