Fedora: Security Advisory for tcpreplay (FEDORA-2023-37bdea9241)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: tcpreplay-4.4.3-3.fc36

Tcpreplay is a tool to replay captured network traffic. Currently, tcpreplay supports pcap tcpdump and snoop capture formats. Also included, is tcpprep a tool to pre-process capture files to allow increased performance under certain conditions as well as capinfo which provides basic information...

[SECURITY] Fedora 38 Update: tcpreplay-4.4.3-3.fc38

Tcpreplay is a tool to replay captured network traffic. Currently, tcpreplay supports pcap tcpdump and snoop capture formats. Also included, is tcpprep a tool to pre-process capture files to allow increased performance under certain conditions as well as capinfo which provides basic information...

The vulnerability of the Git repository management system Gitea lies in its ability to bypass authentication procedures by using capture-replay techniques for intercepted parameters. This allows attackers to circumvent security restrictions, gain unauthorized access to read, modify, or delete data, or execute arbitrary code.

The vulnerability of the Git repository management system Gitea relates to exploiting a authentication process by using capture-replay techniques to intercept and replay captured parameters. Exploiting this vulnerability allows an attacker operating remotely to circumvent security restrictions,...

CVE-2023-31138

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an obje...

CVE-2023-32060

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker...

Design/Logic Flaw

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an obje...

CVE-2023-32060

CVE-2023-32060 affects DHIS2 Core from the 2.35 branch prior to fixes: versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0. The issue is an improper access control for Category Option Combination Sharing that can cause the API endpoints /trackedEntityInstances and /events to return all events regardless...

CVE-2023-32060 DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker...

CVE-2023-32060 DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker...

CVE-2023-32060 DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker...

CVE-2023-31139

DHIS2 Core contains the service layer and Web API. The issue arises in versions prior to 2.37.9.1, 2.38.3.1, and 2.39.1.2, where Personal Access Tokens (PATs) generate unrestricted session cookies, potentially bypassing other access controls (e.g., IP restrictions or HTTP methods). Impact is a by...

CVE-2023-31982

Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capturepacketreasmip at /src/capture.c...

DEBIAN-CVE-2023-31982

Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capturepacketreasmip at /src/capture.c...

UBUNTU-CVE-2023-31982

Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capturepacketreasmip at /src/capture.c...

CVE-2023-31138 DHIS2 Core vulnerable to Improper Access Control with PATCH requests

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an obje...

CVE-2023-31138

CVE-2023-31138 affects DHIS2 Core: starting in the 2.36 branch and before 2.37.9.1, 2.38.3.1, or 2.39.1.2, authenticated users with write access to an object may modify related objects via object model traversal in a PATCH payload. Mitigation is to upgrade to a supported version: 2.37.9.1, 2.38.3...

teampass vulnerable to code injection

In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a for...

Siemens SICAM P850 and SICAM P855 Authentication Bypass By Capture-Replay (CVE-2022-29878)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair...

PT-2023-23554 · Sngrep +1 · Sngrep +1

Name of the Vulnerable Software and Affected Versions: Sngrep version 1.6.0 Description: A heap buffer overflow issue was discovered in the function capture packet reasm ip at /src/capture.c. This issue affects the specified version of Sngrep. Recommendations: For Sngrep version 1.6.0, consider...