USN-6296-1: PostgreSQL vulnerabilities | Cloud Foundry

Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that PostgreSQL incorrectly handled certain extension script substitutions. An attacker having database-level CREATE privileges can use this issue to execute arbitrary code as the...

USN-6535-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Harry Sintonen discovered that curl incorrectly handled mixed case cookie domains. A remote attacker could possibly use this issue to set cookies that get sent to different and unrelated sites and domains...

USN-6538-1: PostgreSQL vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description Jingzhou Fu discovered that PostgreSQL incorrectly handled certain unknown arguments in aggregate function calls. A remote attacker could possibly use this issue to obtain sensitive information...

USN-6513-2: Python vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description USN-6513-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. Original advisory details: It was discovered that Pytho...

USN-6517-1: Perl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that Perl incorrectly handled printing certain warning messages. An attacker could possibly use this issue to cause Perl to consume resources, leading to a denial of service. This issue...

USN-6499-1: GnuTLS vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that GnuTLS had a timing side-channel when handling certain RSA-PSK key exchanges. A remote attacker could possibly use this issue to recover sensitive information. Update Instructions:...

USN-6409-1: GNU C Library vulnerabilities | Cloud Foundry

Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that the GNU C Library incorrectly handled the GLIBCTUNABLES environment variable. An attacker could possibly use this issue to perform a privilege escalation attack. CVE-2023-4911 It w...

USN-6512-1: LibTIFF vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that LibTIFF could be made to run into an infinite loop. If a user or an automated system were tricked into opening a specially crafted imag...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.11. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Metasploit Wrap-Up 03/15/2024

New module content 3 GitLab Password Reset Account Takeover Authors: asterion04 and h00die Type: Auxiliary Pull request: 18716 contributed by h00die Path: admin/http/gitlabpasswordresetaccounttakeover AttackerKB reference: CVE-2023-7028 Description: This adds an exploit module that leverages an...

io.github.project-openubl:quarkus-xsender-deployment (>=5.0.0 <=5.1.1), io.quarkiverse.cxf:quarkus-cxf-deployment (>=2.0.0 <=3.8.0) +29 more potentially affected by CVE-2024-28752 via org.apache.cxf:cxf-rt-databinding-aegis (>=4.0.0 <=4.0.3)

org.apache.cxf:cxf-rt-databinding-aegis MAVEN version =4.0.0, =5.0.0, =2.0.0, =2.7.0, =2.0.0, =2.2.0, =2.2.1, =2.0.0, =2.0.0, =2.0.0, =3.0.0-M2, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.11 and more Source cves: CVE-2024-28752 Source advisory: OSV:G...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to the disclosure of information during data transmission, allows attackers to gain unauthorized access to protected information.

The vulnerability of the CI/CD application integration and delivery system of JetBrains TeamCity is related to the disclosure of information during data transmission. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected informatio...

Authentication flaw

Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the...

io.automatiko.quarkus:automatiko-operator-deployment (>=0.4.0 <=0.54.0), io.javaoperatorsdk:operator-framework-quarkus-extension-deployment (>=1.6.2 <=1.7.5) +18 more potentially affected by CVE-2024-1979 via io.quarkus:quarkus-kubernetes-deployment (>=1.10.0.CR1 <=3.7.2)

io.quarkus:quarkus-kubernetes-deployment MAVEN version =1.10.0.CR1, =0.4.0, =1.6.2, =0.0.3, =0.0.3, =1.0.1, =1.0.1, =4.0.0, =2.0.0, =1.8.0, =6.0.0, =7.2.1, =7.6.1, =7.6.1, =7.6.1, =2.0.0, =3.0.3 and more Source cves: CVE-2024...

"Established connection failed because connected host has failed to respond :10005"

Challenge A Windows Agent Backup or Windows Agent Policy type job within Veeam Backup & Replication fails with either of the following errors. A Veeam Agent Backup operating in Managed by backup server fails with the error: Error: Managed session has failed: A connection attempt failed because th...

Authentication flaw

Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections...

Description of the security update for SharePoint Server 2019: March 12, 2024 (KB5002562)

None None...

Description of the security update for SharePoint Enterprise Server 2016: March 12, 2024 (KB5002559)

None None...

Siemens SENTRON 7KM PAC3x20

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

GO-2024-2602 Incorrect email domain verification in github.com/coder/coder

A vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider such as public...