Facebook Introduces New Features for End-to-End Encrypted Messenger App

Meta Platforms on Monday announced that it has started to expand global testing of end-to-end encryption E2EE in Messenger chats by default. "Over the next few months, more people will continue to see some of their chats gradually being upgraded with an extra layer of protection provided by...

PT-2023-18700 · Unknown +4 · Action Dispatch +4

Name of the Vulnerable Software and Affected Versions: Action Dispatch versions prior to 6.0.6.1 Action Dispatch versions prior to 6.1.7.1 Action Dispatch versions prior to 7.0.4.1 Description: A regular expression based DoS issue in Action Dispatch is related to insufficient input validation...

Design/Logic Flaw

Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the gray-matter npm package, which is vulnerable to JavaScript injection in its default...

Microsoft ends extended support for Windows 7 and Windows Server 2008 today

Time has finally run out for Windows 7 Professional and Enterprise users. Microsoft will stop providing its Extended Security Updates ESU program for the OS version today, January 10. When the company ended its mainstream support for Windows 7 three years ago, it also offered an ESU program to...

PT-2023-13036 · Okta · Okta Oidc Middleware

Name of the Vulnerable Software and Affected Versions: Okta OIDC Middleware versions prior to 5.0.0 Description: An open redirect issue exists, allowing an attacker to redirect a user to an arbitrary URL. To exploit this, an attacker would need to send a victim a malformed URL containing a target...

Unpreparedness for upgrades contracts that SmartAccount inherits

Lines of code Vulnerability details Description The SmartAccount contract inherits many contracts, some of which have their own storage management logic. In case of an upgrade, adding new storage variables to the inherited contracts will colapse the storage layout. This will create an inconvenien...

PT-2023-3407

Name of the Vulnerable Software and Affected Versions Django versions 3.2 through 3.2.18 Django versions 4.0 through 4.1.8 Django versions 4.2 through 4.2.0 Description The issue is related to insufficient input validation in the forms.FileField and forms.ImageField components of the Django web...

PT-2022-11644 · Linkedin · Dustjs

Name of the Vulnerable Software and Affected Versions: LinkedIn dustjs versions up to 2.x LinkedIn dustjs version 3.0.0 Description: A vulnerability was found in LinkedIn dustjs, allowing for improperly controlled modification of object prototype attributes, also known as 'prototype pollution'...

Security Bulletin: A vulnerability in Python affects IBM Elastic Storage System (CVE-2022-0391)

Summary Security vulnerability has been discovered in Python used by Elastic Storage System. Vulnerability Details CVEID:CVE-2022-0391 DESCRIPTION: Python could provide weaker than expected security, cause by a improper input validation by the urllib.parse module. By sending a specially-crafted...

PT-2022-28061 · Typo3 · Fp Newsletter

Name of the Vulnerable Software and Affected Versions: fp newsletter extension versions prior to 1.1.1 fp newsletter extension version 1.2.0 fp newsletter extension versions 2.x prior to 2.1.2 fp newsletter extension versions 2.2.1 through 2.4.0 fp newsletter extension versions 3.x prior to 3.2.6...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.1 release and security update

An update is now available for Red Hat JBoss Web Server 5.7.1 on Red Hat Enterprise Linux versions 7, 8, and 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2022-26178 · Dhis2 · Dhis2

Name of the Vulnerable Software and Affected Versions: DHIS2 versions prior to 2.36.12.1 DHIS2 versions prior to 2.37.8.1 DHIS2 versions prior to 2.38.2.1 DHIS2 versions prior to 2.39.0.1 Description: DHIS 2 is an open source information system for data capture, management, validation, analytics...

Moderate: nodejs:18 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The following packages have been upgraded to a later upstream version: nodejs 18.12.1, nodejs-nodemon 2.0.20. BZ2142818 Security Fixes: nodejs-minimatch: ReDoS vi...

kubernetes security update

kubernetes 1.21.14-3 - Addresses CVE-2022-3294 & CVE-2022-3162 1.21.14-2 - Fixed kubernetes-cni version. 1.21.14-1 - Addresses CVE-2022-3172 olcne 1.4.9-2 - Fix 1.21 kubernetes version to align with last upstream release 1.4.9-1 - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.21...

USN-5739-1 mariadb-10.3, mariadb-10.6 vulnerabilities

Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.37 in Ubuntu 20.04 LTS and to 10.6.11 in Ubuntu 22.04 LTS and Ubuntu 22.10. In addition to security fixes, the updated packages contain b...

PT-2022-26166 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.6RC1 XWiki Platform versions prior to 13.10.8 XWiki Platform versions prior to 14.4.3 Description: The issue allows users without the right to view documents to deduce their existence by repeated Livetable...

python3.9 security, bug fix, and enhancement update

An update is available for python3.9. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming language...

PT-2022-35158 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.14 through v6.0.2 Description: The issue is related to the arm64 architecture and Memory Tagging Extensions MTE in the Linux Kernel. It involves avoiding the setting of PG mte tagged if no tags are cleared or restored...

GHSA-5M7G-PJ8W-7593 Vela Insecure Defaults

Impact Some current default configurations for Vela allow exploitation and container breakouts. Default Privileged Images Running Vela plugins as privileged Docker containers allows a malicious user to easily break out of the container and gain access to the worker host operating system. On a fre...

@keystone-6/core's NODE_ENV defaults to development with esbuild

Impact @keystone-6/[email protected] || 3.0.1 users that use NODEENV in their own code not dependencies to trigger security-sensitive functionality in a production build are vulnerable to NODEENV being inlined to "development" for user code. If your dependencies use NODEENV to trigger particular...