This Week in Spring - Spring Boot 3.2 edition - November 21st, 2023

Hi, Spring fans! Welcome to another epic installment of This Week in Spring! As amazing as the week's already been, it's all leading up to this Thursday - Thanksgiving day! - when we release Spring Boot 3.2! and yes, I am very grateful. This release is stuffed to the gills with a ton of new...

VulnCheck KEV: CVE-2022-38130

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e.,...

CVE-2023-45283

The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...

CVE-2023-46253

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

Design/Logic Flaw

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

CVE-2023-46253 Remote code execution in Squidex

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

CVE-2023-46253 Remote code execution in Squidex

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

CVE-2023-46253 Remote code execution in Squidex

Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore feature which allows an authenticated attacker to gain remote code execution RCE. Squidex allows users with the squidex.admin.restore...

kernel: virtio_net: fix xdp_rxq_info bug after suspend/resume

In the Linux kernel, the following vulnerability has been resolved: virtionet: fix xdprxqinfo bug after suspend/resume The following sequence currently causes a driver bug warning when using virtionet: ip link set eth0 up echo mem /sys/power/state or e.g. rtcwake -s 10 -m mem ip link set eth0 dow...

squidex path traversal vulnerability

squidex is a Headless CMS and Content Management Center. A path traversal vulnerability exists in squidex version 7.8.2, which stems from an arbitrary file write vulnerability in the backup restore feature...

PT-2023-29933 · Squidex · Squidex

Name of the Vulnerable Software and Affected Versions: Squidex versions affected versions not specified Description: The issue concerns an arbitrary file write vulnerability in the backup restore feature of Squidex, allowing an authenticated attacker with the squidex.admin.restore permission to...

Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center

CVE-2023-22518 Improper Authorization Vulnerability in Conflue...

VMXNET3 Drivers Missing From Recovery Media for Server 2022 vSphere VM

Challenge When attempting to perform a Bare Metal Restore on a vSphere VM using Veeam Recovery Media, which was created from a vSphere VM running Server 2022, the network adapter drivers fail to load. This issue persists despite having the 'Include hardware drivers from this computer' option...

Important: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.0.14 security and bug fix update

OpenShift API for Data Protection OADP 1.0.14 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Restore to EC2 Error: "Failed to validate machine: Cannot find a suitable image for the restored machine."

Issue Resolved in Veeam Backup & Replication 12.1 The issue documented in this article was resolved starting in Veeam Backup & Replication 12.1. Veeam strongly encourages all customers to update to the latest version. Challenge A Restore to Amazon EC2 fails with the error: Failed to validate...

Runtime efficiency with Spring (today and tomorrow)

With Spring Framework 6.1 and Spring Boot 3.2 general availability approaching, we would like to share an overview about several efforts the Spring team is pursuing to allow developers to optimize the runtime efficiency of their applications. We are going to cover the following technologies and u...

CVE-2023-34365

A stack-based buffer overflow vulnerability exists in the libutils.so nvramrestore functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to a buffer overflow. An attacker can send a network request to trigger this vulnerability...

PT-2023-6406 · Yifan · Yifan Yf325

Name of the Vulnerable Software and Affected Versions: Yifan YF325 version 1.0 20221108 Description: A stack-based buffer overflow vulnerability exists in the libutils.so nvram restore functionality. This issue can be triggered by a specially crafted network request, leading to a buffer overflow...

RHEL 8 : kernel (RHSA-2023:5628)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5628 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: clsu32 component...

The vulnerability of the restoreSettings function in the Comments Like Dislike plugin of the WordPress content management system allows a hacker to compromise the integrity of the data.

The vulnerability of the restoreSettings function in the WordPress content management system’s comments and dislikes module is related to authentication errors. Exploiting this vulnerability could allow an attacker to compromise data integrity...