CVE-2023-41879

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protectcode". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would...

CVE-2023-41879 Magento LTS's guest order "protect code" can be brute-forced too easily

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protectcode". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would...

CVE-2023-41879 Magento LTS's guest order "protect code" can be brute-forced too easily

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protectcode". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would...

CVE-2023-41879 Magento LTS's guest order "protect code" can be brute-forced too easily

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protectcode". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would...

CVE-2023-41879

CVE-2023-41879 affects Magento OpenMage LTS (Magento LTS) where a guest-order retrieval cookie, guest-view, contains a 6-hex-protect_code. The short entropy (24 bits) enables brute-forcing to view guest orders without authentication, exposing billing/shipping data and order items. Multiple source...

[SECURITY] [DLA 3560-1] libraw security update

Debian LTS Advisory DLA-3560-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin September 10, 2023 https://wiki.debian.org/LTS Package : libraw Version : 0.19.2-2+deb10u4 CVE ID : CVE-2020-22628 A Buffer Overflow vulnerability was found in the LibRaw::stretch...

Debian dla-3560 : libraw-bin - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3560 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3560-1 [email protected] https://www.debian.org/lts/security/...

USN-6339-2: Linux kernel vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service system crash. CVE-2022-48425...

[SECURITY] [DLA 3559-1] libssh2 security update

Debian LTS Advisory DLA-3559-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin September 08, 2023 https://wiki.debian.org/LTS Package : libssh2 Version : 1.8.0-2.1+deb10u1 CVE ID : CVE-2019-13115 CVE-2019-17498 CVE-2020-22218 Debian Bug : 932329 943562...

Debian dla-3558 : python-django - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3558 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3558-1 [email protected] https://www.debian.org/lts/security/...

Debian dla-3557 : memcached - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3557 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3557-1 [email protected] https://www.debian.org/lts/security/...

Ubuntu 22.04 LTS : Linux kernel (GKE) vulnerabilities (USN-6351-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6351-1 advisory. It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker cou...

Ubuntu 20.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-6347-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6347-1 advisory. William Zhao discovered that the Traffic Control TC subsystem in the Linux kernel did not properly handle network packet retransmission in certain...

Debian dla-3551 : otrs - security update

"The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3551 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3551-1 [email protected]...

Debian: Security Advisory (DLA-3550-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dla-3553 : firefox-esr - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3553 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3553-1 [email protected]...

Debian dla-3555 : libapache2-mod-php7.3 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3555 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3555-1 [email protected]...

Debian dla-3552 : gstreamer1.0-plugins-ugly - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3552 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3552-1 [email protected] https://www.debian.org/lts/security/...

Debian dla-3550 : libopendmarc-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3550 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3550-1 [email protected] https://www.debian.org/lts/security/...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : SoX vulnerability (USN-6345-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6345-1 advisory. It was discovered that SoX incorrectly handled certain inputs. If a user or an automated system were tricked into...