CVE-2023-6932

A race condition has been discovered in the Linux kernel's Internet Group Management Protocol IGMP implementation. This vulnerability may enable an attacker to provoke an application crash or potentially escalate privileges locally. By exploiting the race condition, an adversary could disrupt the...

Security Bulletin: NVIDIA Triton Inference Server - December 2023

NVIDIA has released a software update for NVIDIA Triton Inference Server to address the issue disclosed in this bulletin. This issue affects only nondefault deployments that enable dynamic model loading through the model control APIs by using the command line option --model-control explicit...

How to construct "Deployment Rules' for the REST API request to add and update the Public APP Store

This document is to record an easier method to construct the field 'Deployment Rules' in the RESTAPI request to add and update the APP in the Public APP Store...

Security Bulletin: Vulnerability in Cryptography package for Python affects IBM Process Mining CVE-2023-49083

Summary There is a vulnerability in Cryptography package for Python that could allow an attacker to execute denial of service on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Security Bulletin: Vulnerability in Reactor Netty affects IBM Process Mining CVE-2023-34062

Summary There is a vulnerability in Reactor Netty that could allow a remote attacker to traverse directories on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2023-34062...

[SECURITY] Fedora 38 Update: dotnet7.0-7.0.114-1.fc38

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...

Wordfence CLI 2.1.0 Adds Email Capability and Unattended Configuration

Note: This post refers to Wordfence CLI, the command line tool for operations teams to rapidly scan large numbers of WordPress websites for vulnerabilities and malware, not the Wordfence plugin which is deeply integrated into WordPress and provides additional functionality, like a firewall,...

CVE-2023-37329

A heap-based buffer overflow vulnerability was found in the PGS Blu-ray subtitle decoder within GStreamer when processing specific files. This issue could allow a malicious third party to crash the application and execute code by manipulating the heap. Mitigation Mitigation for this issue is eith...

CVE-2023-6291

A flaw was found in the redirecturi validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users. Mitigation Mitigation for this issue...

Imperva Detects Undocumented 8220 Gang Activities

Imperva Threat Research has detected previously undocumented activity from the 8220 gang, which is known for the mass deployment of malware using a variety of continuously evolving TTPs. This threat actor has been known to target both Windows and Linux web servers with cryptojacking malware. In...

Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs...

GHSA-V672-5X3H-57QP Cross-site request forgery vulnerability in Jenkins Deployment Dashboard Plugin

A cross-site request forgery CSRF vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs...

CVE-2023-50775

A cross-site request forgery CSRF vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs...

CVE-2023-50775

CVE-2023-50775 describes a cross-site request forgery (CSRF) in Jenkins Deployment Dashboard Plugin, affecting version 1.0.10 and earlier. The connected Red Hat advisory and other sources confirm the vulnerability allows attackers to copy jobs on the Jenkins controller when the plugin is in use. ...

CVE-2023-50775

A cross-site request forgery CSRF vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs...

CVE-2023-47321

Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets...

Sensitive Information Disclosure

laf-client-sdk is vulnerable to Sensitive Information Disclosure. The vulnerability is caused due to directly inserting env variables into the the template while constructing the deployment instance of the app. Sensitive information in the secret and configmap can be read through the k8s envFrom...

Microsoft Windows Defender Antimalware Platform DoS Vulnerability (Dec 2023)

This host is missing a critical security update according to Microsoft Security Updates released for Microsoft Windows Defender Protection Engine dated 13-12-2023 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

PT-2023-30414

Name of the Vulnerable Software and Affected Versions Silverpeas Core version 6.3.1 Description The issue is related to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlets. Recommendations For Silverpeas Core version 6.3.1, consider restricting...

Jenkins Deployment Dashboard Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...