Apptainer: Privilege Escalation

Background Apptainer is the container system for secure high-performance computing. Description A vulnerability has been discovered in Apptainer. Please review the CVE identifier referenced below for details. Impact There is an ext4 use-after-free flaw that is exploitable in vulnerable versions...

baserCMS Cross-site Scripting Vulnerability in Favorites Feature

There is a XSS Vulnerability in Favorites Feature to baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible. Target baserCMS 4.7.8 and earlier...

APTs Exploiting WinRAR 0day Flaw Despite Patch Availability

By Deeba Ahmed All a user needs to do is visit the official WinRAR website and install the latest version to thwart the attack. This is a post from HackRead.com Read the original post: APTs Exploiting WinRAR 0day Flaw Despite Patch Availability...

Oracle VirtualBox: Multiple Vulnerabilities

Background VirtualBox is a powerful virtualization product from Oracle. Description Multiple vulnerabilities have been discovered in Oracle VirtualBox, the worst of which may lead to VirtualBox compromise by an attacker with network access. Please review the CVE identifiers referenced below for...

Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

PT-2023-8671 · Intel · Intel Qat Software Drivers

Name of the Vulnerable Software and Affected Versions: IntelR QAT software drivers for Windows versions prior to QAT1.7-W-1.11.0 Description: The issue is related to an out-of-bounds read in some IntelR QAT software drivers for Windows, which may allow an authenticated user to potentially enable...

Festo LX Appliance

SUMMARY A vulnerability in the Video.js package could allow a user of LX Appliance, with a high privilege account i.e., with the "Teacher" role, to craft a malicious course and launch an XSS attack. 2. REMEDIATION Contact Festo Didactic services department at [email protected] to...

Soketi was exposed to Sandbox Escape vulnerability via vm2

Impact What kind of vulnerability is it? Who is impacted? Anyone who might have used Soketi with the cluster driver or through PM2. Patches Has the problem been patched? What versions should users upgrade to? Get the latest version of Soketi. Workarounds Is there a way for users to fix or remedia...

Ivanti Endpoint Manager Mobile < 11.3 Remote Unauthenticated API Access (CVE-2023-35082)

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is 11.3. It is, therefore, affected by an undisclosed unauthenticated API access vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the service's...

CVE-2023-36466 Topic Title Validation Skipped When Changing Category in Discourse

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passe...

PT-2023-33055 · Unknown · Connect-Cms

Name of the Vulnerable Software and Affected Versions: Connect-CMS versions 1.7.1 and earlier Connect-CMS versions 2.3.1 and earlier Description: There is a Privilege Escalation issue on the management system of Connect-CMS. Recommendations: For Connect-CMS versions 1.7.1 and earlier, upgrade to...

"NewsPicks" App uses a hard-coded API key for an external service

Overview "NewsPicks" App for Android and "NewsPicks" App for iOS provided by NewsPicks, Inc. use a hard-coded API key for an external service CWE-798. Sunagawa Masanori of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

SYNCK GRAPHICA Mailform Pro CGI vulnerable to Regular expression Denial-of-Service (ReDoS)

Overview Mailform Pro CGI provided by SYNCK GRAPHICA contains a Regular expression Denial-of-Service ReDoS vulnerability CWE-1333. Tran Quang Vu of FPT Software reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

Mozilla Firefox: Multiple Vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

PT-2023-24208 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.9.2 through 1.9.3 Description: Kyverno is a policy engine designed for Kubernetes. The issue concerns the Kyverno seccomp control, which can be circumvented. Users of the podSecurity validate.podSecurity subrule are affecte...

frr security, bug fix, and enhancement update

8.3.1-5 - Resolves: 2147522 - It is not possible to run FRR as a non-root user 8.3.1-4 - Resolves: 2144500 - AVC error when reloading FRR with provided reload script 8.3.1-3 - Related: 2129743 - Adding missing rules for vtysh and other daemons 8.3.1-2 - Resolves: 2128738 - out-of-bounds read in t...

CVE-2023-2512 Buffer under-read in workerd

Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the forEach method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead to a...

LINE WORKS Drive Explorer vulnerable to code injection

Overview LINE WORKS Drive Explorer provided by WORKS MOBILE Japan Corp. contains a code injection vulnerability CWE-94. Koh M. Nakagawa reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An attacker who can log...

AtomicParsley: Multiple Vulnerabilities

Background AtomicParsley is a command line program for manipulating iTunes-style metadata in MPEG4 files. Description Multiple vulnerabilities have been discovered in AtomicParsley. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers...

Mozilla Thunderbird: Multiple Vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...