[SECURITY] [DLA 3681-1] amanda security update

Debian LTS Advisory DLA-3681-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost December 03, 2023 https://wiki.debian.org/LTS Package : amanda Version : 1:3.5.1-2+deb10u2 CVE ID : CVE-2022-37703 CVE-2022-37705 CVE-2023-30577 Debian Bug : 1021017 1029829 1055253 Multip...

Qakbot Takedown Aftermath: Mitigations and Protecting Against Future Threats

The U.S. Department of Justice DOJ and the FBI recently collaborated in a multinational operation to dismantle the notorious Qakbot malware and botnet. While the operation was successful in disrupting this long-running threat, concerns have arisen as it appears that Qakbot may still pose a danger...

WordPress Backup Migration Plugin <= 1.3.6 is vulnerable to Sensitive Data Exposure

Software Backup Migration Type Plugin Vulnerable versions = 1.3.6 Fixed in 1.3.7 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-6266 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 7df0ea44f3d7 Credits Rafshanzani Suhada...

Backup Migration < 1.3.7 - Unauthenticated Arbitrary File Download to Sensitive Information Exposure

Description The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMIBACKUP case of the handledownloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers...

Security Bulletin: AIX is vulnerable to arbitrary command execution due to invscout (CVE-2023-45168)

Summary A vulnerability in the AIX invscout command could allow a non-privileged local user to execute arbitrary commands CVE-2023-45168. Vulnerability Details CVEID:CVE-2023-45168 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the invscout command to...

CVE-2023-45050

CVE-2023-45050 is a Cross-site Scripting (Stored XSS) in Automattic Jetpack – WP Security, Backup, Speed, & Growth (Jetpack) up to version 12.8-a.1. Root cause: improper neutralization of input during web page generation. Affected product: Jetpack plugin for WordPress. Public fix: version 12.8-a....

AIX is vulnerable to arbitrary command execution due to invscout

IBM SECURITY ADVISORY First Issued: Thu Nov 30 10:49:53 CST 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/invscoutadvisory5.asc Security Bulletin: AIX is vulnerable to arbitrary command execution due to invscout CVE-2023-45168...

PT-2023-32632 · Tyler Technologies · Tyler Technologies Court Case Management Plus

Name of the Vulnerable Software and Affected Versions: Tyler Technologies Court Case Management Plus affected versions not specified Description: The issue concerns insufficient permission checks, allowing unauthorized access to sensitive information. Specifically, backups may be stored in a...

PT-2023-29370

Name of the Vulnerable Software and Affected Versions Jetpack – WP Security, Backup, Speed, & Growth versions n/a through 12.8-a.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This mea...

CVE-2023-45050: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a through 12.8-a.1...

CVE-2023-6375: Files or Directories Accessible to External Parties

Tyler Technologies Court Case Management Plus may store backups in a location that can be accessed by a remote, unauthenticated attacker. Backups may contain sensitive information such as database credentials...

EFS Backup Policy Fails With "Not authorized to perform DeleteRecoveryPoint"

Challenge An EFS Backup Policy fails with the message: User: arn:aws:sts:::assumed-role/VEEAM-BACKUP-FOR-AWS-IAM-ROLE-NAME/VeeamBackupSession is not authorized to perform: backup:DeleteRecoveryPoint on resource: arn:aws:backup:AWS-REGION::recovery-point: with an explicit deny in a resource-based...

Important: Red Hat Security Advisory: OpenShift API for Data Protection (OADP) 1.3.0 security update

OpenShift API for Data Protection OADP 1.3.0 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Remote Code Execution

HotelDruid is vulnerable to Remote Code Execution RCE. The vulnerability is via the backup/restore feature. It can lead to compromising Confidentiality, Integrity and Availability of the system...

Updated mariadb packages fix a security vulnerability

Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete DOS of MySQL Server. Additonally a whole bunch of fixes to InnoDB, Replication, Optimizer, Galera, Spider, Backup,... have been applied. See the official release not...

CVE-2023-5737

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings...

Design/Logic Flaw

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings...

Cross site scripting

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks...

CVE-2023-5738 WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSS

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks...

CVE-2023-5738

CVE-2023-5738 affects WordPress Backup & Migration (plugin up to v1.4.4). Root cause: failure to sanitise/escape certain parameters, enabling Cross-Site Scripting by a Subscriber+ user; confirmed stored XSS path via admin-ajax. Patch availability: fixed in v1.4.5; mitigate by upgrading to 1.4.5 o...