The vulnerability of the file system driver in the Windows operating system allows a hacker to increase their privileges.

The vulnerability of the file system driver in the Windows operating system is related to access control deficiencies. Exploiting this vulnerability can allow an attacker to increase their privileges...

ownCloud vulnerability can be used to extract admin passwords

ownCloud has warned users about three critical security flaws in its file-sharing software which, if exploited, could reveal sensitive information and modify files. An especially and potentially impactful one is a vulnerability that could lead to disclosure of sensitive credentials and...

Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5

The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...

The vulnerability of server-based corporate software for monitoring and managing project knowledge bases in Adobe RoboHelp Server lies in the lack of protective measures for SQL query structures, allowing attackers to gain unauthorized access to protected information.

The vulnerability of server-based corporate software for monitoring and managing project knowledge bases in Adobe RoboHelp Server relates to the lack of protective measures for SQL query structures. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorize...

kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route

There are 3 CVEs for the use-after-free flaw found in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system...

kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route

There are 3 CVEs for the use-after-free flaw found in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system...

The vulnerability of the Windows Authentication component in Windows operating systems allows attackers to enhance their privileges.

The vulnerability of the Windows Authentication component in Windows operating systems is related to access control deficiencies. Exploiting this vulnerability can allow attackers to enhance their privileges...

Microsoft’s November 2023 Patch Tuesday Addresses Five Zero-day Vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary In the November Patch Tuesday release, Microsoft addressed a total of 63 CVEs, including three zero-day vulnerabilities. Within this range of vulnerabilities, the security update covered the typic...

CISA Adds Three Security Flaws with Active Exploitation to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added three security flaws to its Known Exploited Vulnerabilities KEV catalog based on evidence of active exploitation in the wild. The vulnerabilities are as follows - CVE-2023-36584 CVSS score: 5.4 - Microsoft Windows...

The vulnerability of the kubelet utility in the Kubernetes cluster management software allows a hacker to elevate their privileges to the level of an administrator.

The vulnerability of the kubelet utility in the Kubernetes cluster management software is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to elevate their privileges to the level of an administrator...

PT-2023-30739 · Rundeck · Rundeck

Name of the Vulnerable Software and Affected Versions: Rundeck versions 4.12.0 through 4.16.0 Description: The issue allows authenticated users to access certain URL paths without necessary authorization checks, potentially enabling them to view or delete jobs. The affected URLs are:...

The vulnerability of the application software interface for data visualization software Apache Superset allows a hacker to probe connections with the database.

The vulnerability of the application software interface for data visualization in Apache Superset is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to remotely check database connections...

CISA Sets a Deadline - Patch Juniper Junos OS Flaws Before November 17

The U.S. Cybersecurity and Infrastructure Security Agency CISA has given a November 17, 2023, deadline for federal agencies and organizations to apply mitigations to secure against a number of security flaws in Juniper Junos OS that came to light in August. The agency on Monday added five...

aiohttp Security Vulnerabilities

aiohttp is an open source asynchronous HTTP client/server framework for asyncio and Python. A security vulnerability exists in aiohttp versions prior to 3.8.6, which stems from a number of problems with the HTTP parser's header parsing that could lead to request smuggling...

The vulnerability of the `makecontext` function in the GNU C Library allows a malicious actor to induce a service failure.

The vulnerability of the makecontext function in the GNU C Library is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

PT-2023-32295 · WordPress · Powr Plugin

Name of the Vulnerable Software and Affected Versions: POWR plugin for WordPress versions up to, and including, 2.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'powr-powr-pack' shortcode due to insufficient input sanitization and output escaping on...

RLSA-2023:6818 Important: Satellite 6.14 security and bug fix update

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool. Security Fixes: golang: net/http, x/net/http2: rapid stream reset...

The vulnerability of NVIDIA Virtual GPU driver’s kernel mode allows a attacker to trigger a service failure.

The vulnerability of NVIDIA Virtual GPU driver’s kernel mode is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to trigger service failures...

The vulnerability of the wksServicePlugin.dll library in NVIDIA Virtual GPU drivers allows a hacker to elevate their privileges.

The vulnerability of the wksServicePlugin.dll library driver for NVIDIA Virtual GPUs is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the system administration programs Sudo-rs lies in insufficient validation of command arguments entered by users. This allows attackers to escalate their privileges by creating a specially crafted user name.

The vulnerability of the system administration programs Sudo-rs is related to insufficient checking of command arguments entered by users. Exploiting this vulnerability allows a malicious actor to enhance their privileges by creating a specially crafted user name...