Adobe Coldfusion vulnerability used in attacks on government servers

The Cybersecurity and Infrastructure Security Agency CISA put out a Cybersecurity Advisory CSA to alert government agencies about cybercriminals using a vulnerability in Adobe Coldfusion to gain initial access to servers. Adobe ColdFusion is a platform for building and deploying web and mobile...

Moderate: Red Hat Enhancement Advisory: OpenShift Container Platform 4.12.35 CNF vRAN extras update

An update for ztp-site-generate-container, topology-aware-lifecycle-manager and bare-metal-event-relay is now available for Red Hat OpenShift Container Platform 4.12. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise...

WordPress Content Aware Sidebars Plugin < 3.19.1 is vulnerable to Cross Site Scripting (XSS)

Software Content Aware Sidebars Type Plugin Vulnerable versions 3.19.1 Fixed in 3.19.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer DEV Institute PSID 7045acf9eb4c Credits Rafie Muhammad Patchstack...

CVE-2023-33189

CVE-2023-33189 affects Pomerium, an identity and context-aware access proxy. The vulnerability arises from incorrect authorization decisions when handling specially crafted requests, enabling total impact on confidentiality, integrity, and availability per CVSS assessments. Affected versions incl...

verifySignatureWithKey - RRSIG RR's Signer's Name is never checked if it matches owner name

Lines of code Vulnerability details Impact According to RFC 4035 and as mentioned in the comments in function "verifySignatureWithKey" , the Signer's name should also be checked if it matches the owner name. If the Signer's Name field of an RRSIG record does not match the owner name of a DNSKEY...

Vulnerabilities fixed in Oracle Communications

Vulnerabilities have been fixed in Oracle Communications. The vulnerabilities allow a malicious party to carry out attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS. Bypassing authentication Remote code execution User rights Access to system data...

CVE-2022-4289

An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users...

UBUNTU-CVE-2022-4289

An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users...

GitLab security vulnerabilities

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from unhidden Google IAP...

virtio-win bug fix and enhancement update

An update is available for virtio-win. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The virtio-win package provides paravirtualized network drivers for most...

Restore or Failback to Server 2022 Hyper-V host fails with "Unable to update VM security descriptor Error"

Article Applicability This article is specific to an error that occurs when attempting to restore or failback to a Hyper-V host running Windows Server 2022 or versions 2004 and 20H2 of the Semi-Annual Channel versions of Windows Server. This article addresses an issue that is mentioned in the Vee...

awarc (>=0.0.1, <=0.0.4), lungs-segmentation (>=1.1.1, <=1.1.2) +1 more potentially affected by CVE-2022-40897 via setuptools (49.2.0)

setuptools PYPI version 49.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - awarc =0.0.1, =1.1.1, =0.0.14, =0.0.17 Source cves: CVE-2022-40897 Source advisory: OSV:GHSA-R9HX-VWMV-Q579...

awarc (>=0.0.1, <=0.0.4), lungs-segmentation (>=1.1.1, <=1.1.2) +1 more potentially affected by CVE-2022-40897 via setuptools (49.2.0)

setuptools PYPI version 49.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - awarc =0.0.1, =1.1.1, =0.0.14, =0.0.17 Source cves: CVE-2022-40897 Source advisory: OSV:PYSEC-2022-43012...

How to Disable Oracle Processing Without Disabling Application-Aware Processing

Purpose This article documents how to disable the processing of Oracle instances by Application-Aware Processing without disabling Application-Aware Processing processing for other applications running on the same machine. Solution Disable Oracle Processing for a VM Protected by Veeam Backup &...

[SECURITY] Fedora 36 Update: open-policy-agent-0.31.0-7.fc36

An open source, general-purpose policy engine. The Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack...

[SECURITY] Fedora 36 Update: open-policy-agent-0.31.0-6.fc36

An open source, general-purpose policy engine. The Open Policy Agent OPA is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack...

WIZPLAT PD065 Denial of Service Vulnerability

WIZPLAT PD065 is a fingerprint-aware secure USB memory from WIZPLAT Korea.A denial of service vulnerability exists in WIZPLAT PD065 v1.19, which stems from a failure to properly verify authentication in the authentication module. An attacker could use this vulnerability to access sensitive data a...

WIZPLAT PD065 security vulnerabilities

WIZPLAT PD065 is a fingerprint-aware secure USB memory from WIZPLAT Korea.A denial of service vulnerability exists in WIZPLAT PD065 v1.19, which stems from a failure to properly verify authentication in the authentication module. An attacker could use this vulnerability to access sensitive data a...

CVE-2022-24797

Pomerium is an identity-aware access proxy. In distributed service mode, Pomerium's Authenticate service exposes pprof debug and prometheus metrics handlers to untrusted traffic. This can leak potentially sensitive environmental information or lead to limited denial of service conditions. This...

CVE-2022-24797

CVE-2022-24797 affects Pomerium in distributed service mode, where the Authenticate service exposes pprof debug and Prometheus metrics endpoints to untrusted traffic. This can leak environmental information and cause limited denial of service. The issue is fixed in v0.17.1. Workarounds include bl...