CVE-2023-20177

A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense FTD Software that occurs when the SSL/TLS connection is configured with a URL Category and the Snort 3 detection engine could allow an unauthenticated, remote attacker to cause the Snort 3 detection engine to...

CVE-2023-20246

Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the configured policies on an affected system. This vulnerability is due to a logic error that occurs when the access control policies are being...

SUSE SLES15 / openSUSE 15 Security Update : redis (SUSE-SU-2023:4290-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4290-1 advisory. - CVE-2023-45145: Fixed a potential permission bypass due to a race condition during UNIX socket creation bsc1216376. Tenable...

CVE-2023-46255 `SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed

SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed e.g. by having a password which contains : the full URI including the provided password is...

CVE-2023-42425

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

CVE-2023-42425

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

Code injection

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

CVE-2023-42425

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

CVE-2023-42425

CVE-2023-42425 affects Turing Video Turing Edge+ EVC5FD v.1.38.6. The issue allows a remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components. CVSS v3.1 base score 9.8 (CRITICAL) with NETWORK attack vector, LOW complexity, no privileges requir...

CVE-2023-42425

An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components...

The vulnerability of the Redis database management system’s socket is related to the disclosure of information in the erroneous data area, allowing attackers to disclose protected information.

The vulnerability of the Redis database management system’s Unix socket is related to the use of a resolution mask. This creates a race condition that allows another process to establish an unauthorized connection within a short period of time. Exploiting this vulnerability can enable a hacker to...

SpiceDB Log Information Disclosure Vulnerability

SpiceDB is a fine-grained permissions database inspired by Google Zanzibar. A log message disclosure vulnerability exists in SpiceDB versions prior to 1.27.0, which stems from the fact that SPICEDBDATASTORECONNURI is disclosed when the URI cannot be resolved, displaying the password in the log...

ROS-20231030-06

The Unix socket vulnerability of the Redis database management system Redis is related to the use of a permissive mask, which creates a race condition that allows for a short period of time for another process to establish an unauthorized connection. Exploitation of the vulnerability could allow ...

PT-2023-18167 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: The issue is related to a use after free condition in Bluetooth, which can cause memory corruption. This could potentially lead to local escalation of privilege when connecting to a...

ROS-20231030-05

Apache HTTP Server vulnerability is related to blocking HTTP/2 connection processing if it was opened with 0 initial sliding window size. was opened with the initial sliding window size set to 0. Exploitation of the vulnerability could Allow an attacker acting remotely to cause a denial of servic...

OESA-2023-1772 mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...

Messaging Service Wiretap Discovered through Expired TLS Cert

Fascinating story of a covert wiretap that was discovered because of an expired TLS certificate: The suspected man-in-the-middle attack was identified when the administrator of jabber.ru, the largest Russian XMPP service, received a notification that one of the servers’ certificates had expired...

CVE-2023-0897

Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session being visible in requests...

CVE-2023-31421

It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to...

Unable to launch HTML5 sessions via gateway when using Secure Storefront IIS

Unable to launch a published desktop session using Citrix Workspace app for HTML5 when connection is via NetScaler. Desktop launches fine when not going through HTML5. When launching directly from Storefront, bypassing netscaler, HTML5 session launches without any issues. When launching HTML5...