CVE-2023-26554

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd...

vitess allows users to create keyspaces that can deny access to already existing keyspaces

Impact Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using vtctldclient GetKeyspaces will also return an error. Note th...

Privilege Escalation

org.apache.james:james-server-cli is vulnerable to Privilege Escalation. The library does not require admin privileges to access the JMX management service by default, which allows a local authenticated attacker to elevate their privileges...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +213 more potentially affected by CVE-2023-29017 via vm2 (>=3.0.0, <=3.9.14)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2.1.1, =0.1.1, =1.0.0, =0.1.0, =2.0.0-beta.0 and more Source cves:...

[SECURITY] Fedora 37 Update: podman-4.4.4-3.fc37

podman Pod Manager is a fully featured container engine that is a simple daemonless tool. podman provides a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=3Dpodman. Most...

CVE-2023-20153

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

CVE-2023-20022

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

CVE-2023-20023

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

Command injection

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

CVE-2023-20021

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

SUSE SLES12 Security Update : runc (SUSE-SU-2023:1726-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1726-1 advisory. - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that...

CVE-2023-20021

CVE-2023-20021 concerns multiple privilege-escalation vulnerabilities in Cisco Identity Services Engine (ISE) related to CLI command handling. The issues arise from insufficient validation of user-supplied CLI input, enabling an authenticated local attacker with Administrator privileges to perfor...

CVE-2023-20023 Cisco Identity Services Engine Privilege Escalation Vulnerabilities

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

Amazon Linux 2023 : wireshark-cli, wireshark-devel (ALAS2023-2023-152)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-152 advisory. ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file CVE-2023-1161 Tenable has extracted the...

CVE-2023-20022

CVE-2023-20022 relates to multiple privilege-escalation vulnerabilities in Cisco Identity Services Engine (ISE) related to command injection via abused CLI commands. The issues arise from insufficient validation of user-supplied input and require an authenticated, local attacker with Administrato...

CVE-2023-20153

Cisco Identity Services Engine (ISE) contains multiple command injection vulnerabilities in specific ISE CLI commands due to insufficient validation of user-supplied input. An authenticated local attacker with Administrator privileges can exploit crafted CLI commands to elevate privileges to root...

CVE-2023-20023

Cisco Identity Services Engine (ISE) CLI command vulnerability: multiple input validation issues allow an authenticated local attacker with Administrator privileges to inject commands and potentially gain root privileges. Affected product: ISE; root cause: insufficient validation of user-supplied...

CVE-2023-20152

Cisco Identity Services Engine (ISE) exposes multiple CLI command injection vulnerabilities. An authenticated local attacker with Administrator privileges can submit crafted CLI input due to insufficient validation, potentially elevating to root and compromising the underlying OS. The issue is do...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.11.34 bug fix and security update

Red Hat OpenShift Container Platform release 4.11.34 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. Red Hat Product Security has rated this update as having a...

CVE-2023-28642

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked /proc...