nautobot-bgp-models (>=0.7.0 <=1.0.0), nautobot-capacity-metrics (>=1.1.0 <=2.1.1) +27 more potentially affected by CVE-2023-48705 via nautobot (>=1.0.3 <=1.6.32)

nautobot PYPI version =1.0.3, =0.7.0, =1.1.0, =1.6.0, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.1.0, =1.0.0, =0.9.0, =1.1.0, =1.2.1 and more Source cves: CVE-2023-48705 Source advisory: OSV:GHSA-CF9F-WMHP-V4PR...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0 <=4.6.0.0), androidx.baselineprofile.apptarget:androidx.baselineprofile.apptarget.gradle.plugin (>=1.2.0-alpha12 <=1.2.0-alpha14) +2274 more potentially affected by CVE-2023-31582 via org.bitbucket.b_c:jose4j (>=0.4.1 <=0.9.2)

org.bitbucket.bc:jose4j MAVEN version =0.4.1, =4.4.0.0, =1.2.0-alpha12, =1.2.0-alpha12, =1.2.0-alpha12, =1.2.0-alpha12, =1.2.0-alpha07, =1.2.0-alpha12, =1.2.0-alpha07, =2.6.0, =2.6.0, =2.6.0, =1.0.0-alpha01, =1.0.0-alpha01,...

1Password reports security incident after breach at Okta

Password manager 1Password says it’s been affected by a breach at Okta, but it reports no user data has been stolen. In a security incident report, 1Password says that a member of its IT team received an unexpected email suggesting they had initiated an Okta report of a list of admins. They hadnt...

UBUNTU-CVE-2023-4576

On Windows, an integer overflow could occur in RecordedSourceSurfaceCreation which resulted in a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape. This bug only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability...

aimmo (>=0.4.0b3098 <=0.27.4b5229), battlehack20 (>=1.0.0 <=1.1.0) +6 more potentially affected by CVE-2023-41039 via restrictedpython (>=4.0.0b4 <=5.2.0)

restrictedpython PYPI version =4.0.0b4, =0.4.0b3098, =1.0.0, =1.0.1, =1.1.1, =0.1.0, =0.3.4, =0.0.41, =0.1047.0, =1.7.36 Source cves: CVE-2023-41039 Source advisory: OSV:GHSA-XJW2-6JM9-RF67...

agent-actors (=0.1.0), agent-reader (>=0.2.1 <=0.2.2) +162 more potentially affected by CVE-2023-38896 via langchain (>=0.0.100 <=0.0.235)

langchain PYPI version =0.0.100, =0.2.1, =0.1.0, =0.1.5, =0.0.1, =0.0.1, =0.0.1, =0.0.5, =0.0.14, =0.1.9, =0.0.33, =0.1.0a0, =0.2.0, =0.1.3, =0.1.5 and more Source cves: CVE-2023-38896 Source advisory: OSV:GHSA-92J5-3459-QGP4...

HPESBHF04514 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00828, 2023.3 IPU - Intel Processor Advisory, (GDS/Gather/Downfall),Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4510 Gen10 System - Prior to 2.9007-20-2023 HPE ProLiant XL230k Gen10 Server - Prior to 2.9007-20-2023 HPE Apollo 4200 Gen10 Server - Prior to 2.9007-20-2023 HPE...

@deanc/kysely-schema-generator (>=0.0.1 <=0.1.2), @donny94/utils-calendar (>=1.0.0 <=5.0.0) +89 more potentially affected by CVE-2023-37478 via pnpm (>=8.10.2 <=8.15.9)

pnpm NPM version =8.10.2, =0.0.1, =1.0.0, =0.0.5, =0.0.1-beta.17, =0.1.0, =0.1.11 and more Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

2vyper (=0.3.0), ape-safe (=0.6.0) +27 more potentially affected by CVE-2023-37902 via vyper (>=0.1.0b12 <=0.3.7)

vyper PYPI version =0.1.0b12, =0.7.1, =0.1.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0, =0.1.0, =0.7.2, =0.1.10.0, =1.0.1, =0.1.0, =1.4.0, =0.2.1, =0.3.5 and more Source cves: CVE-2023-37902 Source advisory: OSV:PYSEC-2023-133...

CVE-2023-36835 Junos OS: QFX10000 Series: All traffic will be dropped after a specific valid IP packet has been received which needs to be routed over a VXLAN tunnel

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on QFX10000 Series allows a network based attacker to cause a Denial of Service DoS. If a specific valid IP packet is received and that packet needs to be routed...

Microsoft PostScript Printer Driver 安全漏洞

Microsoft PostScript Printer Driver is a Microsoft standard printer driver for PostScript printers from Microsoft Corporation USA. A security vulnerability exists in Microsoft PostScript Printer Driver. An attacker could exploit the vulnerability to obtain sensitive information. The following...

Cl0p ransomware gang claims first victims of the MOVEit vulnerability

On Friday June 2, 2023 we reported about a MOVEit Transfer vulnerability that was actively being exploited. If your organization uses MOVEit Transfer and you havent patched yet, it really is time to move it. Excuse the bad pun, but yesterday we saw the first victims of this vulnerability come...

Zyxel Issues Critical Security Patches for Firewall and VPN Products

Zyxel has released software updates to address two critical security flaws affecting select firewall and VPN products that could be abused by remote attackers to achieve code execution. Both the flaws – CVE-2023-33009 and CVE-2023-33010 – are buffer overflow vulnerabilities and are rated 9.8 out ...

accord-nlp (>=0.1.0 <=0.1.8), adamix-gpt2 (>=0.0.1 <=0.0.2) +560 more potentially affected by CVE-2023-2800 via transformers (>=2.10.0 <=4.2.2)

transformers PYPI version =2.10.0, =0.1.0, =0.0.1, =0.3.0, =0.1.0, =0.1.0, =0.0.8, =0.0.4, =0.0.4, =0.0.11, =1.8.20, =0.0.3, =1.9.0, =1.0.0, =1.1.0 and more Source cves: CVE-2023-2800 Source advisory: OSV:PYSEC-2023-299...

2vyper (=0.3.0), ape-safe (=0.6.0) +27 more potentially affected by CVE-2023-32059 via vyper (>=0.1.0b12 <=0.3.7)

vyper PYPI version =0.1.0b12, =0.7.1, =0.1.0, =0.0.0, =0.0.0, =0.0.5, =0.1.0, =0.1.0, =0.7.2, =0.1.10.0, =1.0.1, =0.1.0, =1.4.0, =0.2.1, =0.3.5 and more Source cves: CVE-2023-32059 Source advisory: OSV:GHSA-PH9X-4VC9-M39G...

@ableaura/ableui (=0.1.0), @accodeing/gatsby-theme-heimr (>=0.65.0 <=0.65.1) +873 more potentially affected by CVE-2023-30548 via gatsby-plugin-sharp (>=5.0.0 <=5.6.0)

gatsby-plugin-sharp NPM version =5.0.0, =0.65.0, =5.0.0-rc1, =2018.4.29-10, =3.0.0, =1.0.0, =1.0.13, =2.1.0, =2.0.0, =1.5.0, =3.0.0, =3.0.0, =1.0.42, =1.0.5, =0.3.0, =0.3.27-beta.0 and more Source cves: CVE-2023-30548 Source advisory: OSV:GHSA-H2PM-378C-PCXX...

CVE-2023-28432 Minio Information Disclosure in Cluster Deployment

Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in information disclosure. All users of...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +1602 more potentially affected by CVE-2023-27904 via org.jenkins-ci.main:jenkins-core (>=1.396 <=2.37)

org.jenkins-ci.main:jenkins-core MAVEN version =1.396, =1.1, =0.0.1, =1.0, =1.0, =0.0.1, =0.1.0, =1.0, =0.9, =1.3, =1.0.5.0, =1.0.6.1 and more Source cves: CVE-2023-27904 Source advisory: OSV:GHSA-RRGP-C2W8-6VG6...

PT-2023-35419 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.95 Description: A potential security issue exists in the Linux Kernel. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prior to v5.15.95, upda...

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

A pair of serious security defects has been disclosed in the Trusted Platform Module TPM 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation. One of the vulnerabilities, CVE-2023-1017 , concerns an out-of-bounds write, while the other,...