kernel security and bug fix update

5.14.0-284.18.12 - cifs: fix wrong unlock before return from cifstreeconnect - docs: Remove the unnecessary unicode character - perf vendor events intel: Refresh ivytown metrics and events - perf vendor events: Update Intel ivytown - perf vendor events intel: Refresh jaketown metrics and events -...

network.2percentrealty.ca Cross Site Scripting vulnerability OBB-3547049

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Oracle Solaris Critical Patch Update : jul2023_SRU11_4_58_144_3

This Solaris system is missing necessary patches to address critical security updates : %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the Oracle CPU for jul2023. include'deprecatednasllevel.inc'; include'compat.inc'...

CVE-2023-28023

The CVE-2023-28023 issue affects the BigFix WebUI Software Distribution interface (versions prior to 44). A cross-site request forgery allows an attacker to access files on server-side systems (server machine and networked hosts). The PT Security advisory for BigFix WebUI recommends upgrading to ...

EulerOS 2.0 SP10 : libssh (EulerOS-SA-2023-2358)

According to the versions of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a...

EulerOS 2.0 SP10 : perl (EulerOS-SA-2023-2390)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. CVE-2023-31484 Note that Tenable Network Security...

EulerOS 2.0 SP10 : binutils (EulerOS-SA-2023-2347)

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Field thebfd of asymbol is uninitialized in function bfdmachogetsyntheticsymtabCVE-2023-25588 A flaw was found in binutils, where there is a NULL...

CVE-2023-34141

CVE-2023-34141 affects Zyxel devices (ATP series, USG FLEX series including USG FLEX 50(W), USG20(W)-VPN, VPN series; NXC2500 and NXC5500) with firmware ranges up to 5.36 Patch 2 or 6.10 AAIG/AAOS variants. Description: a command-injection in the access point (AP) management feature could allow a...

CVE-2023-34138

CVE-2023-34138 describes a command injection in Zyxel hotspot management that allows an unauthenticated, LAN‑based attacker to run OS commands on affected devices by convincing an authorized admin to pre‑allow the attacker's IP via the trusted RADIUS list. Affected firmware: Zyxel ATP series 4.60...

CVE-2023-31851

Cudy LT400 1.13.4 is has a cross-site scripting XSS vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter...

CVE-2023-36850

CVE-2023-36850 describes an improper validation of index/position/offset in Juniper Networks Junos OS CFM that causes the MPC on MX Series to crash when malformed CFM packets are received, leading to a sustained DoS if CFM is not configured. Affected: Junos OS on MX Series (excluding MPC10, MPC11...

SAP NetWeaver AS ABAP Improper Authentication (July 2023)

SAP NetWeaver Application Server for ABAP and ABAP Platform is affected by an improper authentication vulnerability. Under some conditions, improper authentication checks are performed for functionalities that require user identity. An attacker can perform malicious actions over the network,...

CVE-2023-37565

CVE-2023-37565 is a code-injection vulnerability in ELECOM WRC-series wireless LAN routers. A network-adjacent authenticated attacker can execute arbitrary OS commands by sending a specially crafted request, affecting multiple models (e.g., WRC-1167GHBK-S, WRC-1167GEBK-S, WRC-1167FEBK-S, WRC-1167...

CVE-2023-37568

CVE-2023-37568 affects ELECOM wireless LAN routers WRC-1167GHBK-S (v1.03 and earlier) and WRC-1167GEBK-S (v1.03 and earlier). The vulnerability is a command injection via the router’s web management page that allows a network-adjacent, authenticated attacker to execute arbitrary commands. Exploit...

Siemens RUGGEDCOM ROX Cross-Site Request Forgery Vulnerability

RUGGEDCOM products offer a degree of robustness and reliability that sets the standard for communication networks deployed in harsh environments. A cross-site request forgery vulnerability exists in the Siemens RUGGEDCOM ROX, which can be exploited by an attacker to perform arbitrary actions on t...

CVE-2023-35874

CVE-2023-35874 affects SAP NetWeaver Application Server ABAP and ABAP Platform, specifically versions 7.22 through 7.93 (KRNL64NUC/UC, etc.). The root cause is improper authentication checks for functionalities that require user identity, enabling a network-based attacker to perform malicious act...

EulerOS 2.0 SP9 : python3 (EulerOS-SA-2023-2339)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2023-2317)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain...

EulerOS 2.0 SP9 : python-cryptography (EulerOS-SA-2023-2320)

According to the versions of the python-cryptography package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions...

CVE-2023-36456

authentik is an open-source Identity Provider. Prior to versions 2023.4.3 and 2023.5.5, authentik does not verify the source of the X-Forwarded-For and X-Real-IP headers, both in the Python code and the go code. Only authentik setups that are directly accessible by users without a reverse proxy a...