Potential URI resolution path traversal in the AWS SDK for PHP

More info at https://nvd.nist.gov/vuln/detail/CVE-2023-51651...

Denial Of Service (DoS)

github.com/free5gc/free5gc is vulnerable to Denial Of Service DoS. The vulnerability exists due to a null pointer dereference when failing to resolve the IP of a ngap message resulting in an application crash...

Command injection

Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote authenticated users, this MAY permit remote users to gain root privileges. Hadoop 3.3.0 updated the "...

CVE-2023-26031 Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systems

Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote authenticated users, this MAY permit remote users to gain root privileges. Hadoop 3.3.0 updated the "...

2023-11 Cumulative Update for Windows 10 Version 22H2 for x86-based Systems (KB5032189)

Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer...

Moderate: c-ares security update

The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. Security Fixes: c-ares: Heap buffer over read in aresparsesoareply CVE-2020-22217 c-ares: Buffer Underwrite in aresinetnetpton CVE-2023-31130 For more details about the security issues,...

Symfony potential Cross-site Scripting in WebhookController

Description The error message in WebhookController returns unescaped user-submitted input. Resolution WebhookController now doesn't return any user-submitted input in its response. The patch for this issue is available here for branch 6.3. Credits We would like to thank Maxime Aknin for reporting...

GHSA-72X2-5C85-6WMR Symfony potential Cross-site Scripting in WebhookController

Description The error message in WebhookController returns unescaped user-submitted input. Resolution WebhookController now doesn't return any user-submitted input in its response. The patch for this issue is available here for branch 6.3. Credits We would like to thank Maxime Aknin for reporting...

Crawlector - Threat Hunting Framework Designed For Scanning Websites For Malicious Objects

Crawlector the name Crawlector is a combination of Crawl er & Detector is a threat hunting framework designed for scanning websites for malicious objects. Note-1 : The framework was first presented at the No Hat conference in Bergamo, Italy on October 22nd, 2022 Slides, YouTube Recording. Also, i...

kernel security, bug fix, and enhancement update

5.14.0-362.8.13.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

SUSE CVE-2023-6069

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...

libqb security update

2.0.6-4 - bump rpm version for rhel-exception build Resolves: rhbz2230712 2.0.6-3 - blackbox: fix buffer overflow with long log lines Resolves: rhbz2236171 2.0.6-1 - ipc: Retry receiving credentials if the the message is short Resolves: rhbz2149647 2.0.6-1 - Rebase to 2.0.6 Resolves: rhbz2072903...

grafana security and enhancement update

9.2.10-7 - bump release number for rebuild with fixed gating.yaml file 9.2.10-6 - resolve RHEL-12665 - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work - testing is turned off due to test failures caused by testing date mismatch 9.2.10-5 - resolve CVE-2023-3128...

Input validation

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...

CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...

CVE-2023-6069 Improper Link Resolution Before File Access in froxlor/froxlor

Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0...

CVE-2023-46733: Possible session fixation

Affected versions Symfony versions =5.4.21, 5.4.31, and = 6.2.7, 6.3.8 of the Symfony Security HTTP component are affected by this security issue. The issue has been fixed in Symfony 5.4.31, 6.3.8. Description SessionStrategyListener does not always migrate the session after a successful login. I...

WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.6 is vulnerable to Broken Access Control

Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.2.6 Fixed in 3.2.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47693 Patch priority High CVSS severity High 7.5 Developer Themefic PSID bddec613524f Credits minhtuanact...

CVE-2023-5978

CVE-2023-5978 affects FreeBSD 13-RELEASE up to 13-RELEASE-p4 where the cap_net libcasper(3) service incorrectly validates updated constraint lists, allowing an application that specifies only a resolvable domain list to submit a new list including previously unlisted domains and thus resolve doma...

NewStart CGSL MAIN 6.06 : bind Multiple Vulnerabilities (NS-SA-2023-0134)

The remote NewStart CGSL host, running version MAIN 6.06, has bind packages installed that are affected by multiple vulnerabilities: - BIND 9.11.0 - 9.11.36 9.12.0 - 9.16.26 9.17.0 - 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 - 9.11.36-S1 9.16.8-S1 - 9.16.26-S1 Versions of BIND 9 earlier...