samba: SMB2 packet signing is not enforced when "server signing = required" is set

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

Zimbra Fixes A Zero-Day Vulnerability Exploited in Attacks

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The vulnerability CVE-2023-37580 in Zimbra Collaboration Suite ZCS version 8.8.15 is a Cross-Site Scripting XSS flaw in the Zimbra Classic Web Client interface. Its impact is severe as it can...

The vulnerability of the JavaFX component in Oracle Java SE software allows attackers to compromise data integrity.

The vulnerability of Oracle Java SE’s JavaFX software platforms is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

The vulnerability of the Envoy proxy server stems from a lack of mechanisms for encoding or filtering output data, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Envoy proxy server is related to the lack of mechanisms for encoding or filtering output data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

EulerOS Virtualization 3.0.6.6 : dnsmasq (EulerOS-SA-2023-2421)

According to the versions of the dnsmasq packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface,...

The vulnerability of the MyHandlerInterceptor class in the ProSafe Network Management NMS300 system’s management, diagnosis, and optimization of network device operations allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the MyHandlerInterceptor class in the ProSafe Network Management NMS300 system, which is used for management, diagnosis, and optimization of network device operations, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a...

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System (GMS) global network firewall management system lies in the use of a password hash instead of a password for authentication. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System’s global network gateways is related to the use of a password hash instead of a password for authentication. Exploiting this vulnerability allows a malicious actor to compromise the...

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System (GMS) global network firewall management system lies in the use of cryptographic algorithms with hard-programmed keys for encryption. This allows attackers to compromise the integrity of the protected information.

The vulnerability of the SonicWall Analytics analytical service and the SonicWall Global Management System’s global network gateways is related to the use of cryptographic algorithms for encryption with a hard-programmed key. Exploiting this vulnerability could allow an attacker, operating...

The vulnerability of the u32_set_parms() function in the net/sched/cls_u32.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the u32setparms function in the net/sched/clsu32.c module of the Linux operating system is related to incorrect handling of usage counters. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of data...

The vulnerability of the nft_immediateDestroy() function in the net/netfilter/nft_immediate.c module of the Netfilter subsystem in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the nftimmediateDestroy function in the net/netfilter/nftimmediate.c module of the Netfilter subsystem in the Linux operating system is related to incorrect handling of usage counters. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the xfrm_state_walk_done() function in the net/xfrm/xfrm_user.c module of the XFRM subsystem in the Linux operating system allows a attacker to compromise the integrity, confidentiality, or accessibility of data, or to enhance their privileges.

The vulnerability of the xfrmstatewalkdone function in the net/xfrm/xfrmuser.c module of the XFRM subsystem in the Linux operating system is related to the use of uninitialized variables. Exploiting this vulnerability could allow an attacker to compromise the integrity, confidentiality, or...

The vulnerability of the nft_chain_lookup_byid() function in the net/netfilter/nf_tables_api.c module of the Linux kernel’s netfilter packet filtering subsystem allows a attacker to escalate their privileges and compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nftchainlookupbyid function in the net/netfilter/nftablesapi.c module of the Linux kernel’s packet filtering subsystem is related to the reutilization of previously freed memory due to concurrent access to resources. Exploiting this vulnerability could allow an attacker t...

AZL-48166 CVE-2023-3347 affecting package samba 4.18.3-2

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

CVE-2023-3347

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

Design/Logic Flaw

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

CVE-2023-3347

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

CVE-2023-3347 Samba: smb2 packet signing is not enforced when "server signing = required" is set

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

OpenJDK: HTTP client insufficient file name validation (8302475)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6, 22.3.2; Oracle...

OpenJDK: improper handling of slash characters in URI-to-path conversion (8305312)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u371, 8u371-perf, 11.0.19, 17.0.7, 20.0.1; Oracle GraalVM Enterprise Edition: 20.3.10, 21.3.6,...

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially crafted HTML page...