SUSE: Security Advisory (SUSE-SU-2022:23018-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for libeconf, shadow and util-linux (moderate)

openSUSE Security Update: Security update for libeconf, shadow and util-linux Announcement ID: openSUSE-SU-2022:0727-1 Rating: moderate References: 1188507 1192954 1193632 1194976 SLE-23384 SLE-23402 Cross-References: CVE-2021-3995 CVE-2021-3996 CVSS scores: CVE-2021-3995 SUSE: 4.7...

USN-5305-1: MariaDB vulnerabilities

Several security issues were discovered in MariaDB and this update includes new upstream MariaDB versions to fix these issues. MariaDB has been updated to 10.3.34 in Ubuntu 20.04 LTS and to 10.5.15 in Ubuntu 21.10. In addition to security fixes, the updated packages contain bug fixes, new feature...

GitLab Enterprise Edition 和 GitLab Community Edition 访问控制错误漏洞

GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. An access control error vulnerability exists in GitLab Enterprise Edition and GitLab Community Edition, which stems from improperly restricted access. A remote...

Metasploit Weekly Wrap-Up

Exchange RCE Exchange remote code execution vulnerabilities are always valuable exploits to have. This week Metasploit added an exploit for an authenticated RCE in Microsoft Exchange servers 2016 and server 2019 identified as CVE-2021-42321. The flaw leveraged by the exploit exists in a...

[SECURITY] Fedora 34 Update: python2.7-2.7.18-20.fc34

Python 2 is an old version of the language that is incompatible with the 3.x line of releases. The language is mostly the same, but many details, especial ly how built-in objects like dictionaries and strings work, have changed considerably, and a lot of deprecated features have finally been...

CLSA-2022-1645465490 Fix CVE(s): CVE-2021-32036

SECURITY UPDATE: Denial of Service and Data Integrity vulnerability in features command - debian/patches/CVE-2021-32036.patch: Check action type for oidReset - CVE-2021-32036...

OPENSUSE-SU-2022:0047-1 Security update for opera

This update for opera fixes the following issues: Update to 83.0.4254.27 - CHR-8737 Update chromium on desktop-stable-97-4254 to 97.0.4692.99 - DNA-96336 Mac Translate new network installer slogan - DNA-96678 Add battery level monitoring capability to powerSavePrivate - DNA-96939 Crash at...

OPENSUSE-SU-2022:0037-1 Security update for firejail

This update for firejail fixes the following issues: - Update Leap 15.3 package to 0.9.68 boo1195880 update to firejail 0.9.68: - security: on Ubuntu, the PPA is now recommended over the distro package - see README.md 4748 - security: bugfix: private-cwd leaks access to the entire filesystem -...

Metasploit Wrap-Up

Welcome, Little Hippo: PetitPotam Our very own @zeroSteiner ported the PetitPotam exploit to Metasploit this week. This module leverages CVE-2021-36942, a vulnerability in the Windows Encrypting File System EFS API, to capture machine NTLM hashes. This uses the EfsRpcOpenFileRaw function of the...

GHSA-3C7P-VV5R-CMR5 Incorrect Authorization in Apache Solr

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous which could be used for remote code execution to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such featur...

Microsoft: Slow MFA adoption presents “dangerous mismatch” in security

Multi-factor authentication MFA has been around for many years now, but few enterprises have fully embraced it. In fact, according to Microsofts inaugural "Cyber Signals" report, only 22 percent of all its Azure Active Directory AD enterprise clients have adopted two-factor authentication 2FA, a...

Palestine-Aligned Hackers Use New NimbleMamba Implant in Recent Attacks

An advanced persistent threat APT hacking group operating with motives that likely align with Palestine has embarked on a new campaign that takes advantage of a previously undocumented implant called NimbleMamba. The intrusions leveraged a sophisticated attack chain targeting Middle Eastern...

Medusa Malware Joins Flubot’s Android Distribution Network

Flubot, the Android spyware that’s been spreading virally since last year, has hitched its infrastructure wagon up to another mobile threat known as Medusa. That’s according to ThreatFabric, which found that Medusa is now being distributed through the same SMS-phishing infrastructure as Flubot,...

Virtuozzo Hybrid Infrastructure 5.0 (5.0.0-137)

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' interoperability and help expand their services. The improvements cover compute services, object storage, security, and monitoring. Additionally, this release delivers stability...

PT-2022-1980

Name of the Vulnerable Software and Affected Versions Microsoft Word affected versions not specified Description The issue is related to errors in security settings of Microsoft Office and Microsoft 365 Apps for Enterprise packages, which can allow an attacker to bypass security features...

UBUNTU-CVE-2021-32036

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This...

Design/Logic Flaw

An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions. This...

CVE-2021-32036

Removed by vendor...

PT-2022-10062 · Mongodb +1 · Mongodb Server +2

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to and including 5.0.3 MongoDB Server versions prior to and including 4.4.9 MongoDB Server versions prior to and including 4.2.16 MongoDB Server versions prior to and including 4.0.28 Description: An authenticate...