Security update for liferea (important)

openSUSE Security Update: Security update for liferea Announcement ID: openSUSE-SU-2023:0096-1 Rating: important References: 1193579 1209190 Cross-References: CVE-2023-1350 CVSS scores: CVE-2023-1350 NVD : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-1350 SUSE: 8.8...

Vulnerabilities of operating systems iOS and iPadOS, related to lack of access control, allow attackers to gain unauthorized access to protected information.

The vulnerabilities of operating systems iOS and iPadOS are related to lack of access control. Exploiting these vulnerabilities can allow attackers to gain unauthorized access to protected information through special features...

AppFW (WAF) Learning not working anymore

The learning for WAF features is not working anymore, no new data is learned. Even after cleaning the AppFW learning data CLI command 'reset appfw learningdata', WAF learning is not working as no new data is learned...

LockBit ransomware on Mac: Should we worry?

One of the big headlines over the weekend is LockBit, the high-profile Russian ransomware gang, decided to expand its portfolio of potential victims by creating and releasing its first macOS payload, potentially triggering members of the Apple community to panic. But have no fear: Apple security...

[SECURITY] Fedora 38 Update: mediawiki-1.39.3-1.fc38

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

SUSE-SU-2023:1850-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: - Update to Java 8.0 Service Refresh 8 bsc1208480: Security fixes: - CVE-2023-21830: Fixed improper restrictions in CORBA deserialization bsc1207249. - CVE-2023-21835: Fixed handshake DoS attack against DTLS connections bsc1207246. -...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using WebSphere Application Server Liberty is vulnerable to server-side request forgery due to Apache CXF - CVE-2022-46364

Summary IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery due to Apache CXF. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack, it has been addressed in this bulletin: Jazz Foundation, IBM Engineering Workflow Management, I...

CVE-2023-26756

The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. NOTE: The vendor's position is that this is effectively mitigated by rate limits and password-quality features...

The vulnerability of the 3CX Electron Desktop App for messaging and video conferencing software for Windows and macOS operating systems allows a hacker to execute arbitrary code.

The vulnerability of the 3CX Electron Desktop App for messaging and video conferencing software for Windows and macOS operating systems is related to the presence of undeclared features in its microprogramming. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

SUSE-SU-2023:1823-1 Security update for java-1_8_0-ibm

This update for java-180-ibm fixes the following issues: - Update to Java 8.0 Service Refresh 8 bsc1208480: Security fixes: - CVE-2023-21830: Fixed improper restrictions in CORBA deserialization bsc1207249. - CVE-2023-21835: Fixed handshake DoS attack against DTLS connections bsc1207246. -...

CVE-2022-46717

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features...

CVE-2022-46717

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features...

Apple iOS 和 iPadOS 安全漏洞

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in iOS prior to 16.2 and iPadOS prior to 16.2, which originates from the possibility...

CVE-2023-1802

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

CVE-2023-1802

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

Hardcoded credentials

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

CVE-2023-1802 In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

CVE-2023-1802

CVE-2023-1802 affects Docker Desktop 4.17.x where the Artifactory Integration falls back to sending registry credentials over plain HTTP when the HTTPS health check fails. This can allow a targeted network sniffing attack to disclose sensitive information. Affected users are those who have enable...

kernel: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix copyxstatetouabi to copy init states correctly When an extended state component is not present in fpstate, but in init state, the function copies from initfpstate via copyfeature. But, dynamic states are not present ...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from Google, an American company. An information disclosure vulnerability exists in Google Chrome Accessibility, which stems from an out-of-bounds read issue with accessibility features. A remote attacker could exploit this vulnerability to obtain sensitive...