Important: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.1.5 security and bug fix update

OpenShift API for Data Protection OADP 1.1.5 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2023-35158

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

CVE-2023-35158

XWiki Platform is vulnerable to a reflected XSS via the xredirect parameter in the restore template. The flaw allows injecting JavaScript into pages when a crafted URL is visited (exists since 9.4-rc-1). Affected versions include 9.4-rc-1 onward; patched in 14.10.5 and 15.1-rc-1. Remediation: upg...

CVE-2023-35158 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

XWiki Platform 安全漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the XWiki Foundation in France. A security vulnerability exists in XWiki Platform versions prior to 9.4-rc-1. An attacker can exploit this vulnerability to inject Javascript code into a page by forging a...

GHSA-MWXJ-G7FW-7HC8 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alertdocument.domain This...

kernel: OOB access in the Linux kernel's XFS subsystem

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system...

How to Configure the Azure Restore Proxy Appliance Size

Purpose This article documents how to override the default Azure Restore Proxy Appliance size. Challenge Attempting to restore a Linux workload fails to Microsoft Azure when using a proxy appliance size that is not available for subscriptions that have VM size limitations. The following error may...

CVE-2023-2638

Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives. This vulnerability may allow a local, authenticated non-admin...

CVE-2023-2638

Rockwell Automation's FactoryTalk System Services does not verify that a backup configuration archive is password protected. Improper authorization in FTSSBackupRestore.exe may lead to the loading of malicious configuration archives. This vulnerability may allow a local, authenticated non-admin...

PT-2023-3651 · Rockwell Automation · Factorytalk System Services

Name of the Vulnerable Software and Affected Versions: FactoryTalk System Services affected versions not specified Description: The issue is related to improper authorization in the FTSSBackupRestore.exe executable, which may allow a local, authenticated non-admin user to load malicious...

CVE-2023-3098

A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restoreallsoundfile. The manipulation leads to path traversal: '../filedir'. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used...

PT-2023-23096 · Kylinsoft · Youker-Assistant

Name of the Vulnerable Software and Affected Versions: KylinSoft youker-assistant versions prior to 3.0.2-0kylin6k70-23 Description: A critical issue has been found in the restore all sound file function, allowing for path traversal manipulation, such as '../filedir'. This issue requires local...

Exploit for CVE-2023-33781

CVE-2023-33781 Description D-Link DIR-842V2 v1.0.3 was dis...

Support Statement regarding Microsoft CVE-2023-24932

Challenge Microsoft recently released update KB5025885 containing changes to secure boot. These changes require specific actions to be taken to continue using Veeam Agent for Microsoft Windows bare metal recovery media and other restore operations. After applying the Microsoft Update with...

CVE-2023-2124

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system...

CVE-2023-2124

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system...

DEBIAN-CVE-2023-2124

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure with a dirty log journal. This flaw allows a local user to crash or potentially escalate their privileges on the system...

The vulnerability of the phpcgi component in D-Link DIR-879 A1 microprogramming router software allows a hacker to bypass security restrictions and restore login credentials for accessing the system.

The vulnerability of the phpcgi component in D-Link DIR-879 A1 router microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and restore access credentials for entering the system by...

The vulnerability of the Restore Workspace function in SCADA systems’ SCADA Data Gateway (SDG) allows a intruder to execute arbitrary code.

The vulnerability of the Restore Workspace function in SCADA systems’ SCADA Data Gateway SDG is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...