Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Circumvention of security measure Remote code execution User rights Access to sensitive...

Microsoft Windows Internet Connection Sharing (ICS) security vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Internet Connection Sharing ICS. An attacker exploiting this vulnerability could remotely execute code. The...

PT-2023-5062 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient input validation in the Internet Connection Sharing ICS function of the Windows operating system. This can be exploited by a remote attacker to execute...

PT-2025-53189

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak in the kcm sendmsg function. The issue occurs when an error happens after some bytes have been copied during message sending, leaving the last skb...

Apache Superset Security Bypass Vulnerability (CNVD-2024-06819)

Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. A security bypass vulnerability exists in Apache Superset version 2.1.0 and earlier, which can be exploited by an attacker to register a SQLite database connection...

Apache Superset Security Bypass Vulnerability (CNVD-2024-06820)

Apache Superset is an open source data visualization tool based on Python. Apache Superset suffers from a security bypass vulnerability that can be exploited by an attacker to test a database connection...

CVE-2023-41578

Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection...

CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

UBUNTU-CVE-2023-39321

Processing an incomplete post-handshake message for a QUIC connection can cause a panic...

CVE-2023-39322 Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size...

CVE-2023-39321

CVE-2023-39321 describes a panic caused by processing an incomplete post-handshake message in QUIC connections within the Go crypto/tls stack. Connected sources indicate the issue is fixed in Go crypto/tls (with related CVEs 2023-39322) and are referenced in advisories from F5 and AlmaLinux (ALSA...

CVE-2023-39321

Removed by vendor...

GOM Player 2.3.90.5360 - Remote Code Execution (RCE)

Exploit Title: GOM Player 2.3.90.5360 - Remote Code Execution RCE Date: 26.08.2023 Author: M. Akil Gündoğan Contact: https://twitter.com/akilgundogan Vendor Homepage: https://www.gomlab.com/gomplayer-media-player/ Software Link: https://cdn.gomlab.com/gretech/player/GOMPLAYERGLOBALSETUPNEW.EXE...

SSLVPN error "Websocket connection failed: Connection closed before receiving a handshake responser"

After VPN tunnel established to NetScaler gateway, user encounter access issue s to backend server with error message: "Websocket connection to 'ws:///ws/notification/site-msg/' failed: Connection closed before receiving a handshake responser"...

PT-2023-27983 · Jeecg · Jeecg

Name of the Vulnerable Software and Affected Versions: Jeecg versions up to 3.5.3 Description: The issue is an arbitrary file read vulnerability. It can be exploited via the interface "/testConnection". Recommendations: For versions up to 3.5.3, as a temporary workaround, consider restricting...

Amazon Linux 2023 : amazon-ssm-agent (ALAS2023-2023-339)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-339 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Oracle Linux 5 : nss_ldap (ELSA-2008-0389)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2008-0389 advisory. 253-12 - rebuild 253-11 - backport changes to group parsing from version 254 to fix heap corruption when parsing nested groups 444031 253-10 - remove unnecessar...

Oracle Linux 8 : bind (ELSA-2020-1845)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1845 advisory. 32:9.11.13-3 - Fix rwlock to be thread-safe 1740511 32:9.11.13-2 - Release GeoIP data on reload 1790879 32:9.11.13-1 - Update to 9.11.13 32:9.11.12-5 - Report...

The vulnerability of the Cisco Emergency Responder, Cisco Unified Communications Manager, and Cisco Unified Communications Manager Session Management Edition (SME) systems, as well as the Cisco Unity Connection messaging system, stems from deficiencies in access control. This allows attackers to escalate their privileges.

The vulnerability of the Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition SME, and Cisco Unity Connection systems related to message exchange systems is linked to deficiencies in access control for update files...