CVE-2023-34923

TOPdesk CVE-2023-34923 involves XML Signature Wrapping (XSW) in the SAML-based SSO of TOPdesk v12.10.12. The vulnerability affects the SAML Response handling and, per the description, allows attackers with valid credentials to authenticate with the Identity Provider and impersonate any TOPdesk us...

SUSE SLED15 / SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:2322-2)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2322-2 advisory. - rebuild the package with the go 1.19 security release bsc1200441. Tenable has extracted the preceding description blo...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : terraform-provider-null (SUSE-SU-2023:2261-2)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2261-2 advisory. - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658. Tenable has extracted the...

PT-2023-3195 · Kops · Kops

Name of the Vulnerable Software and Affected Versions: kOps affected versions not specified Description: The issue is related to errors in permission handling in the GCP Provider component of the kOps tool, which is used for automated management of Kubernetes virtual machine clusters. Exploitatio...

CVE-2023-34923

XML Signature Wrapping XSW in SAML-based Single Sign-on feature in TOPdesk v12.10.12 allows bad actors with credentials to authenticate with the Identity Provider IP to impersonate any TOPdesk user via SAML Response manipulation...

GHSA-77FW-RF4V-VFP9 passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token

Information Please note that this is not a new disclosure, and is previously reported in our SECURITY-NOTICE.md which we removed in favor of github advisory. Overview This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity...

SUSE-SU-2023:2261-2 Security update for terraform-provider-null

This update of terraform-provider-null fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658...

SUSE-SU-2023:2253-2 Security update for terraform-provider-aws

This update of terraform-provider-aws fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658...

SUSE-SU-2023:2322-2 Security update for terraform-provider-helm

This update of terraform-provider-helm fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441...

PT-2023-36174 · Google +1 · Go +1

Name of the Vulnerable Software and Affected Versions: terraform-provider-aws affected versions not specified Description: The issue is related to a security release in Go 1.19, which is used to rebuild the terraform-provider-aws package. Recommendations: At the moment, there is no information...

PT-2023-36186 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in Go 1.19. The estimated number of potentially affected devices worldwide is not available. There is no information about...

PT-2023-25664 · Shibboleth +3 · Shibboleth Xmltooling-C +4

Name of the Vulnerable Software and Affected Versions: Shibboleth XMLTooling versions prior to 3.2.4 Shibboleth Service Provider versions prior to 3.4.1.3 Description: The issue allows Server-Side Request Forgery SSRF via a crafted KeyInfo element. This can be exploited by manipulating the KeyInf...

Build Numbers and Versions of Veeam Service Provider Console

This KB article lists all versions of Veeam Service Provider Console and their respective build numbers. For more information on downloading the latest version of Veeam Service Provider Console, visit: Veeam Service Provider Console -- Current Version Download Page Veeam Service Provider Console ...

CVE-2023-26062

A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administrative functions. Exploitation is not possible from outside of mobile network solution architecture. This means that exploit is not possibl...

CVE-2023-26062

A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user can execute administrative functions. Exploitation is not possible from outside of mobile network solution architecture. This means that exploit is not possibl...

CVE-2023-29372

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...

CVE-2023-29367

iSCSI Target WMI Provider Remote Code Execution Vulnerability...

Remote code execution

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...

Remote code execution

iSCSI Target WMI Provider Remote Code Execution Vulnerability...

Siemens Mendix SAML Authentication Bypass Vulnerability

The Mendix SAML module allows you to authenticate users in cloud applications using SAML. The module can communicate with any identity provider that supports SAML 2.0 or Shibboleth. An authentication bypass vulnerability exists in Siemens Mendix SAML, which can be exploited by an attacker to bypa...