Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : FreeRDP vulnerabilities (USN-6522-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6522-1 advisory. It was discovered that FreeRDP incorrectly handled drive redirection. If a user were tricked into connection to a malicious...

Important: Red Hat Security Advisory: tigervnc security update

An update for tigervnc is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as...

CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...

Code injection

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...

Stable Channel Update for Desktop

The Stable channel has been updated to 119.0.6045.199 for Mac and Linux and 119.0.6045.199/.200 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Security Fixes and Rewards Note: Access to bug details and links may be kept...

CVE-2023-49314: Improper Control of Generation of Code

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...

CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...

Asana Desktop Security Vulnerability

Asana Desktop is a desktop body application. A security vulnerability exists in Asana Desktop version 2.1.0, which stems from insufficient protection against code injection via RunAsNode, EnableNodeCliInspectArguments, and other settings, and can be exploited via r3ggi/ electroniz3r...

CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...

PT-2023-31164 · Asana · Asana Desktop

Name of the Vulnerable Software and Affected Versions: Asana Desktop version 2.1.0 Description: The issue allows code injection due to specific Electron Fuses, with inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments. This can be...

CVE-2023-49314

CVE-2023-49314 affects multiple entries and is linked to insecure Electron Fuses in macOS applications. Asana Desktop 2.1.0 on macOS is vulnerable due to inadequate protection against code injection via settings like RunAsNode and EnableNodeCliInspectArguments, enabling local attackers to leverag...

m-privacy TightGate-Pro Code Execution / Insecure Permissions

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: m-privacy TightGate-Pro vulnerable version: Rolling Release, servers with the following package versions are vulnerable: tightgatevnc...

CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack...

CVE-2023-47250

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers with access to a VNC session to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop,...

Autodesk Desktop Connector Code Issue Vulnerability

Autodesk Desktop Connector is a desktop connection software from Autodesk, Inc. A security vulnerability exists in Autodesk Desktop Connector 16.2.1 and earlier versions, which stems from a maliciously crafted DLL file that could be forced to install to a non-default location and could be used by...

m-privacy TightGate-Pro Server Security Vulnerability

The m-privacy TightGate-Pro Server is a remote control browser system from the German company m-privacy. A security vulnerability exists in m-privacy TightGate-Pro Server versions prior to 2.0.406g, which originates from an easily compromised access control on X11 server sockets, allowing an...

CVE-2023-47250

In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers with access to a VNC session to access the X11 desktops of other users by specifying their DISPLAY ID. This allows complete control of their desktop,...

PT-2023-30392 · Unknown · Mprivacy-Tools

Name of the Vulnerable Software and Affected Versions: mprivacy-tools versions prior to 2.0.406g Description: The issue allows authenticated attackers with access to a VNC session to bypass access control on X11 server sockets. By specifying the DISPLAY ID of other users, attackers can gain...

Oracle Linux 8 : flatpak (ELSA-2023-7038)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7038 advisory. 1.10.8-1 - Rebase to 1.10.8 2222103 - Fix CVE-2023-28100 and CVE-2023-28101 2180311 Tenable has extracted the preceding description block directly from...

Debian: Security Advisory (DLA-3654-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...