Ubuntu 16.04 ESM : Salt vulnerabilities (USN-4769-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4769-1 advisory. It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this vulnerability to...

[SECURITY] [DLA 3623-1] linux-5.10 security update

Debian LTS Advisory DLA-3623-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings October 19, 2023 https://wiki.debian.org/LTS Package : linux-5.10 Version : 5.10.197-1deb10u1 CVE ID : CVE-2022-4269 CVE-2022-39189 CVE-2023-1206 CVE-2023-1380 CVE-2023-2002 CVE-2023-2007...

In-Depth Analysis of AvosLocker Ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary AvosLocker also known as Avos, is a ransomware-as-a-service that targets critical infrastructure organizations, primarily in the US, and has expanded to target both Windows and Linux systems. Its...

US House Republicans Had Their Phones Confiscated to Stop Leaks

In an attempt to wrest control from raucous far-right hardliners amid the fight for a new House speaker, Republican Party leaders are instituting phone bans to keep backroom deals secret...

SUSE SLES15: cluster-md-kmp-azure / dlm-kmp-azure / gfs2-kmp-azure / etc (SUSE-SU-2023:4057-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4057-1 advisory. The SUSE Linux Enterprise 15 SP4 Azure kernel was updated to receive various security and bugfixes. The following...

USN-6430-1 ffmpeg vulnerabilities

It was discovered that FFmpeg did not properly handle certain inputs in vflagfun.c, resulting in a buffer overflow vulnerability. An attacker could possibly use this issue to cause a denial of service via application crash. This issue only affected Ubuntu 20.04 LTS. CVE-2020-22024 It was discover...

Xen: missing IOMMU TLB flushing (XSA-442)

The caching invalidation guidelines from the AMD-Vi specification 48882—Rev 3.07-PUB—Oct 2022 is incorrect on some hardware, as devices will malfunction see stale DMA mappings if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can point to memory...

x86/AMD: missing IOMMU TLB flushing

ISSUE DESCRIPTION The caching invalidation guidelines from the AMD-Vi specification 48882—Rev 3.07-PUB—Oct 2022 is incorrect on some hardware, as devices will malfunction see stale DMA mappings if some fields of the DTE are updated but the IOMMU TLB is not flushed. Such stale DMA mappings can poi...

Huawei EulerOS: Security Advisory for binutils (EulerOS-SA-2023-2891)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6413-1 binutils vulnerabilities

It was discovered that GNU binutils was not properly performing checks when dealing with memory allocation operations, which could lead to excessive memory consumption. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. CVE-2017-1712...

Dell EMC NetWorker Improper Authorization (DSA-2023-294)

The version of Dell EMC NetWorker installed on the remote Windows host is 19.7.0.x prior to 19.7.0.5, 19.7.1.x, 19.8.x prior to 19.8.0.3, or 19.9.x prior to 19.9.0.2. It is, therefore, affected by an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within...

CVE-2023-20251

A vulnerability in the memory buffer of Cisco Wireless LAN Controller WLC AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot. This vulnerability is due to memory leaks caused by multiple clients connecting under...

Design/Logic Flaw

A vulnerability in the memory buffer of Cisco Wireless LAN Controller WLC AireOS Software could allow an unauthenticated, adjacent attacker to cause memory leaks that could eventually lead to a device reboot. This vulnerability is due to memory leaks caused by multiple clients connecting under...

CVE-2023-20251

CVE-2023-20251 affects Cisco Wireless LAN Controller (WLC) AireOS Software. The issue is described as a vulnerability in the memory buffer that allows an unauthenticated, adjacent attacker to trigger memory leaks by orchestrating multiple wireless clients to connect to an access point, which can ...

CVE-2023-28055

Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could potentially exploit this by manipulating a command leading to gain of complete access to the server file further resulting in information...

CVE-2023-28055

Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could potentially exploit this by manipulating a command leading to gain of complete access to the server file further resulting in information...

Authorization

Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could potentially exploit this by manipulating a command leading to gain of complete access to the server file further resulting in information...

CVE-2023-28055

Dell EMC NetWorker client (Dell NetWorker 19.7) is affected by an improper authorization vulnerability. An unauthenticated adversary on the same network can manipulate commands to gain full access to server files, enabling information leaks, DoS, and arbitrary code execution. Affected versions pe...

CVE-2023-28055

Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could potentially exploit this by manipulating a command leading to gain of complete access to the server file further resulting in information...

CVE-2023-28055

Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could potentially exploit this by manipulating a command leading to gain of complete access to the server file further resulting in information...