Rocky Linux 8 : Satellite 6.14 (RLSA-2023:6818)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6818 advisory. - A flaw was found in all versions of kubeclient up to but not including v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfi...

rubygem-activerecord: Denial of Service

A flaw was found in the rubygem-activerecord. RubyGem's ActiveRecord is vulnerable to a denial of service caused by a flaw in the PostgreSQL adapter. By sending a specially-crafted request, a remote attacker can cause a slow sequential scan, resulting in a denial of service...

kernel: media: dvb-usb: fix memory leak in dvb_usb_adapter_init()

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: fix memory leak in dvbusbadapterinit Syzbot reports a memory leak in "dvbusbadapterinit". The leak is due to not accounting for and freeing current iteration's adapter-priv in case of an error. Currently if an err...

kernel: scsi: mpi3mr: Fix an issue found by KASAN

A flaw was found in the Linux kernel's mpi3mr SCSI driver for Broadcom MPI3 HBA controllers. The driver writes 64 bytes when only 32 bytes should be written, causing an out-of-bounds write detected by KASAN. This memory corruption could lead to system instability or a kernel crash...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, aws-efs-csi-driver-fips, terraform-provider-sendgrid-fips, kubevela, dgraph, conftest-fips, kubeflow, prometheus-stackdriver-exporter, smarter-device-manager-fips, terraform-provider-sendgrid, buildkitd, prometheus-adapter-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: src, k3d, aactl, kubeflow, terraform-provider-sendgrid, up, kubescape, buildkitd, spark-operator, dgraph, cortex, kubevela, scorecard, slsa-verifier...

CVE-2023-39231

PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's...

CVE-2023-37283

Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter...

CVE-2023-37283

Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter...

PT-2023-25882 · Ping Identity · Pingfederate Identifier First Adapter

Name of the Vulnerable Software and Affected Versions: PingFederate Identifier First Adapter affected versions not specified Description: The issue allows for authentication bypass under a very specific and highly unrecommended configuration in the PingFederate Identifier First Adapter...

CVE-2023-39231

CVE-2023-39231 affects PingFederate with the PingOne MFA adapter, where a threat actor who knows a victim’s first-factor credentials can pair a new MFA device without second-factor authentication. Core impact is unauthorized MFA enrollment, risking account compromise. Affected product/adapter and...

[SECURITY] Fedora 37 Update: python-asgiref-3.5.2-1.fc37

ASGI is a standard for Python asynchronous web apps and servers to communicate with each other, and positioned as an asynchronous successor to WSGI. This package includes ASGI base libraries, such as: Sync-to-async and async-to-sync function wrappers, asgiref.sync Server base classes,...

OPENSUSE-SU-2023:0307-1 Security update for bluetuith

This update for bluetuith fixes the following issues: - Update to 0.1.7: New HJSON-based configuration format Adapter status indicators Cancellable OBEX session creation Enhanced popups Major bugfixes and improvements - Update to 0.1.5: ui: device: Show address if name is empty agent: Display...

PT-2023-35513 · Bluetuith · Bluetuith

Name of the Vulnerable Software and Affected Versions: bluetuith versions prior to 0.1.7 bluetuith versions prior to 0.1.5 Description: The issue is related to a vulnerability in bluetuith that has been resolved by updating dependencies. The updates also include new features and bugfixes, such as...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: caddy, rancher-webhook-fips, kubevela, rancher-webhook, k3s, up, kubernetes-fips, metrics-server-fips, buildkitd, prometheus-adapter, kubernetes, kube-oidc-proxy...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: caddy, prometheus-adapter, up, buildkitd, k3s, kubernetes, kubevela...

AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

CVE-2023-35647

In ProtocolEmbmsGlobalCellIdAdapter::Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation...

PT-2023-25237 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a possible out of bounds read in the ProtocolEmbmsGlobalCellIdAdapter::Init function of protocolembmsadapter.cpp due to a missing bounds check. This could lead to...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kind, nats, kaf, pulumi-language-dotnet, skaffold, grype, dex, ko, newrelic-infrastructure-agent, memcached-exporter, prometheus-adapter, frp, mc, oauth2-proxy, pulumi-language-yaml, aactl, wireguard-go, fuse-overlayfs-snapshotter, kubeflow, kots, cosign, conftest,...