Default credentials

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12...

PT-2023-16195

Name of the Vulnerable Software and Affected Versions MongoDB Ops Manager versions 5.0 through 5.0.20 MongoDB Ops Manager versions 6.0 through 6.0.11 Description The issue affects MongoDB Ops Manager Diagnostics Archive, where it may not redact sensitive PEM key file password app settings. Howeve...

Huawei EulerOS: Security Advisory for tar (EulerOS-SA-2023-2198)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-0342 MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12...

CVE-2023-0342

CVE-2023-0342 affects MongoDB Ops Manager: Diagnostics Archive may reveal the SAML SSL Pem Key File Password in app settings. Vulnerable on Ops Manager v5.0 before 5.0.21 and v6.0 before 6.0.12; archives do not include PEM files themselves. A Metasploit auxiliary module exists to retrieve the unr...

CVE-2023-0342 MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12...

CVE-2023-0342: Exposure of Sensitive System Information to an Unauthorized Control Sphere

MongoDB Ops Manager Diagnostics Archive may not redact sensitive PEM key file password app settings. Archives do not include the PEM files themselves. This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and MongoDB Ops Manager v6.0 prior to 6.0.12...

SUSE SLES12: libpython3_6m1_0 / libpython3_6m1_0-32bit / python36 / etc (SUSE-SU-2023:2473-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2473-1 advisory. - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750. - Fixed unittest.mock.patch.dict returns function when applied to coroutine...

CVE-2023-2866

If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server...

Huawei EulerOS: Security Advisory for tar (EulerOS-SA-2023-2131)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

archive-it.org Cross Site Scripting vulnerability OBB-3394648

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Satacom delivers browser extension that steals cryptocurrency

Satacom downloader, also known as LegionLoader, is a renowned malware family that emerged in 2019. It is known to use the technique of querying DNS servers to obtain the base64-encoded URL in order to receive the next stage of another malware family currently distributed by Satacom. The Satacom...

PT-2023-22802 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 4.0.0 through 4.0.9 Apache Cassandra versions 4.1.0 through 4.1.1 Description: The issue is related to privilege escalation when enabling FQL/Audit logs, allowing a user with JMX access to run arbitrary commands as t...

CVE-2023-30571

Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask call inside archivewritediskposix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race...

Don't Click That ZIP File! Phishers Weaponizing .ZIP Domains to Trick Victims

A new phishing technique called "file archiver in the browser" can be leveraged to "emulate" a file archiver software in a web browser when a victim visits a .ZIP domain. "With this phishing attack, you simulate a file archiver software e.g., WinRAR in the browser and use a .zip domain to make it...

Libarchive race condition vulnerabilities

libarchive is a multi-format archive and compression library. A security vulnerability exists in libarchive 3.6.2 and earlier versions, which stems from a problem with the archivewritediskposix.c file, and can be exploited by an attacker to delete or rename files in a directory...

PT-2023-4600 · Unknown +3 · Libarchive +3

Name of the Vulnerable Software and Affected Versions: Libarchive versions 3.6.2 and earlier Description: The issue is caused by a race condition with the umask call inside archive write disk posix.c, which can lead to a permanent umask 0 setting. This can result in implicit directory creation wi...

Talend Data Catalog security vulnerabilities

Talend Data Catalog is a tool that combines data cataloging and metadata management from Talend. It is used to connect data from platforms, databases, and analytic tools to generate a holistic view of the information supply chain in a language everyone can understand. A security vulnerability...

Debian: Security Advisory (DLA-3432-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-41221

The client in OpenText Archive Center Administration through 21.2 allows XXE attacks. Authenticated users of the OpenText Archive Center Administration client Versions 16.2.3, 21.2, and older versions could upload XML files to the application that it did not sufficiently validate. As a result,...