PYSEC-2023-201

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/id/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version...

CVE-2023-41882 vantage6 Improper Access Control vulnerability

vantage6 is privacy preserving federated learning infrastructure. The endpoint /api/collaboration/id/task is used to collect all tasks from a certain collaboration. To get such tasks, a user should have permission to view the collaboration and to view the tasks in it. However, prior to version...

vantage6 Code Issue Vulnerability

vantage6 is a vantage6 open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A code issue vulnerability exists in vantage6 versions prior to 3.3.3, which stems from the endpoint /api/collaboration/id/task is used to collect all tasks for a collaboration,...

PT-2023-21864

Name of the Vulnerable Software and Affected Versions vantage6 versions prior to 4.0.0 Description The issue affects vantage6, a privacy-preserving federated learning infrastructure. Malicious users may attempt to access resources they are not allowed to see by creating resources with integers as...

aicscytoparam (>=0.1.1 <=0.1.2), aicsimageio (>=3.3.6 <=3.3.7) +45 more potentially affected by CVE-2023-4863 +1 more via imagecodecs (>=2019.12.31 <=2023.7.10)

imagecodecs PYPI version =2019.12.31, =0.1.1, =3.3.6, =1.10.0, =0.1.13, =1.2.9, =1.1.0, =1.1.15, =1.2.0, =2.0.0, =0.1.1, =0.4.0, =0.1.1, =2021.11.20, =2022.9.26 and more Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:GHSA-94VC-P8W7-5P49...

Newsletter Lite < 4.9.3 - Admin+ Command Injection

Description The plugin does not properly escape user-controlled parameters when they are appended to SQL queries and shell commands, which could enable an administrator to run arbitrary commands on the server. 1 Navigate to "Newsletters Configuration History & Emails Configuration"...

WMIExec - Set Of Python Scripts Which Perform Different Ways Of Command Execution Via WMI Protocol

Set of python scripts which perform different ways of command execution via WMI protocol. Blog Post https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ Usage wmiexecscheduledjob.py Is a python script which authenticates to a remote WMI instance and execute commands vi...

aicscytoparam (>=0.1.1 <=0.1.2), aicsimageio (>=3.3.6 <=3.3.7) +45 more potentially affected by CVE-2023-4863 +1 more via imagecodecs (>=2019.12.31 <=2023.7.10)

imagecodecs PYPI version =2019.12.31, =0.1.1, =3.3.6, =1.10.0, =0.1.13, =1.2.9, =1.1.0, =1.1.15, =1.2.0, =2.0.0, =0.1.1, =0.4.0, =0.1.1, =2021.11.20, =2022.9.26 and more Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:PYSEC-2023-174...

CVE-2023-4987

A vulnerability, which was classified as critical, has been found in infinitietech taskhub 2.8.7. Affected by this issue is some unknown functionality of the file /home/gettaskslist of the component GET Parameter Handler. The manipulation of the argument project/status/userid/sort/search leads to...

OESA-2023-1627 rubygem-railties security update

Rails internals: application bootup, plugins, generators, and rake tasks. Railties is responsible to glue all frameworks together. Overall, it: handles all the bootstrapping process for a Rails application; manages rails command line interface; provides Rails generators core; Security Fixes:...

Infinitietech Taskhub SQL Injection Vulnerability

Infinitietech Taskhub is Infinitietech open source a project management, finance, CRM tools. Infinitietech Taskhub version 2.8.7 SQL injection vulnerability , the vulnerability stems from the component GET Parameter Handler /home/gettaskslist there is an unknown function , through the parameter...

Microsoft Windows Multiple Vulnerabilities (KB5030213)

This host is missing an important security update according to Microsoft KB5030213 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

September 12, 2023—KB5030216 (OS Build 20348.1970)

None None...

September 12, 2023—KB5030214 (OS Build 17763.4851) - EXPIRED

None None...

Oracle Linux 7 : libvirt (ELSA-2019-4687)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4687 advisory. - logging: restrict sockets to mode 0600 Daniel P. Berrange Orabug: 29861433 CVE-2019-10132 - locking: restrict sockets to mode 0600 Daniel P. Berrange Orabug:...

ruby:2.7 security, bug fix, and enhancement update

An update is available for module.rubygem-abrt, rubygem-mysql2, module.rubygem-pg, module.rubygem-bson, ruby, rubygem-bson, rubygem-pg, rubygem-mongo, module.rubygem-mysql2, rubygem-abrt, module.ruby, module.rubygem-mongo. This update affects Rocky Linux 8. A Common Vulnerability Scoring System...

Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle

Ask any security professional and they'll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate "fixer" somewhere in the organization. Thi...

RLSA-2023:4378 Important: kernel-rt security and bug fix update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: ipvlan: out-of-bounds write caused by unclear skb-cb CVE-2023-3090 kernel: clsflower: out-of-bounds write in flsetgeneveopt...

Important: Red Hat Security Advisory: Red Hat Virtualization Host 4.4.z SP 1 security update

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base...

CVE-2022-46901

An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This...