Airbus AoA – Angle of Attack sensor issue

I read a lot of air incident investigation reports. The aviation industry is a shining example of sharing and learning, resulting in increased safety. I wish that the cyber industry on the ground could find a way to effectively share similar experiences and learnings. Anyway, one report caught my...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...

CVE-2022-40089

A remote file inclusion RFI vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploitable when the directive allowurlinclude is set to On...

Moderate: booth security update

The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inputs to local Pacemaker cluster resource managers. It operates as a distributed consensus-based service, presumably on a separate physical network...

booth: authfile directive in booth config file is completely ignored.

A flaw was found in booth in the way it handles the authfile directive in configuration files, which causes authentication to be skipped between nodes. As a result, an attacker-controlled node that does not have the correct authentication key does not prevent communication with other nodes in the...

RHEL 8 : booth (RHSA-2022:6439)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:6439 advisory. The Booth cluster ticket manager is a component to bridge high availability clusters spanning multiple sites, in particular, to provide decision inpu...

Malicious code in directive-daterange (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bc603ac7127f5b2855fe13c5a99358ecd1088161c6092b06577ffb5f22e4ceb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2477 Malicious code in directive-daterange (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bc603ac7127f5b2855fe13c5a99358ecd1088161c6092b06577ffb5f22e4ceb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

booth: authfile directive in booth config file is completely ignored.

A flaw was found in booth in the way it handles the authfile directive in configuration files, which causes authentication to be skipped between nodes. As a result, an attacker-controlled node that does not have the correct authentication key does not prevent communication with other nodes in the...

animation-directive (>=1.0.0 <=1.1.1), lrc-common (=1.1.1) +1 more potentially affected by unknown CVE via webpack-cil (=0.0.1-security)

webpack-cil NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on webpack-cil and may be impacted: - animation-directive =1.0.0, =1.0.0, =1.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2022-7100...

OESA-2022-1827 mod_wsgi security update

The modwsgi adapter is an Apache module that provides a WSGI compliant interface for hosting Python based web applications within Apache. The adapter is written completely in C code against the Apache C runtime andfor hosting WSGI applications within Apache has a lower overhead than using existin...

Insecure Configuration

booth:sid is using insecure configuration. The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in...

ruby:2.5 security update

ruby 2.5.9-110 - Fix FTBFS due to an incompatible load directive. - Fix a fiddle import test on an optimized glibc on Power 9. - Fix by adding length limit option for methods that parses date strings. Resolves: CVE-2021-41817 - CGI::Cookie.parse no longer decodes cookie names to prevent spoofing...

SUSE SLES15 Security Update : booth (SUSE-SU-2022:2606-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2022:2606-1 advisory. - CVE-2022-2553: authfile directive in booth config file is completely ignored bsc1201946. Tenable has extracted the preceding description block direct...

SUSE-SU-2022:2609-1 Security update for booth

This update for booth fixes the following issues: - CVE-2022-2553: authfile directive in booth config file is completely ignored bsc1201946...

SUSE-SU-2022:2607-1 Security update for booth

This update for booth fixes the following issues: - CVE-2022-2553: authfile directive in booth config file is completely ignored bsc1201946...

SUSE-SU-2022:2605-1 Security update for booth

This update for booth fixes the following issues: - CVE-2022-2553: authfile directive in booth config file is completely ignored bsc1201946...

CVE-2022-2553

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster...

CVE-2022-2553

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster...

AZL-36933 CVE-2022-2553 affecting package booth for versions less than 1.0-8

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster...