CVE-2023-43662

ShokoServer exposes the /api/Image/WithPath endpoint without authentication in affected versions, passing serverImagePath to System.IO.File.OpenRead without sanitization, enabling arbitrary file reads via a path-traversal/LFI pattern. This can leak sensitive server files, particularly when the Wi...

Emergency update! Apple patches three zero-days

Apple has released security updates for several products to address a handful of zero-day vulnerabilities that may already have been used by criminals. Updates are available for: iOS 16.7 and iPadOS 16.7 iOS 17.0.1 and iPadOS 17.0.1 watchOS 9.6.3 watchOS 10.0.1 macOS Ventura 13.6 macOS Monterey...

Apple Rushes to Patch 3 New Zero-Day Flaws: iOS, macOS, Safari, and More Vulnerable

Apple has released yet another round of security patches to address three actively exploited zero-day flaws impacting iOS, iPadOS, macOS, watchOS, and Safari, taking the total tally of zero-day bugs discovered in its software this year to 16. The list of security vulnerabilities is as follows -...

[slackware-security] bind

New bind packages are available for Slackware 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/bind-9.16.44-i586-1slack15.0.txz: Upgraded. This update fixes bugs and a security issue: Limit the amount of recursion that can be...

About the security content of Safari 16.6.1

About the security content of Safari 16.6.1 This document describes the security content of Safari 16.6.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

excel-lab.de Cross Site Scripting vulnerability OBB-3679503

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Russian Journalist's iPhone Compromised by NSO Group's Zero-Click Spyware

The iPhone belonging to Galina Timchenko, a prominent Russian journalist and critic of the government, was compromised with NSO Group's Pegasus spyware, a new collaborative investigation from Access Now and the Citizen Lab has revealed. The infiltration is said to have happened on or around...

Adobe, Apple, Google & Microsoft Patch 0-Day Bugs

Microsoft today issued software updates to fix at least five dozen security holes in Windows and supported software, including patches for two zero-day vulnerabilities that are already being exploited. Also, Adobe, Google Chrome and Apple iOS users may have their own zero-day patching to do. On...

Google Rushes to Patch Critical Chrome Vulnerability Exploited in the Wild - Update Now

Google on Monday rolled out out-of-band security patches to address a critical security flaw in its Chrome web browser that it said has been exploited in the wild. Tracked as CVE-2023-4863, the issue has been described as a case of heap buffer overflow that resides in the WebP image format that...

[slackware-security] vim

New vim packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/vim-9.0.1897-i586-1slack15.0.txz: Upgraded. Fixed three use-after-free security issues. Thanks to marav for the heads-up. For more...

Apple Rushes to Patch Zero-Day Flaws Exploited for Pegasus Spyware on iPhones

Apple on Thursday released emergency security updates for iOS, iPadOS, macOS, and watchOS to address two zero-day flaws that have been exploited in the wild to deliver NSO Group's Pegasus mercenary spyware. The issues are described as below - CVE-2023-41061 - A validation issue in Wallet that...

About the security content of iOS 16.6.1 and iPadOS 16.6.1

About the security content of iOS 16.6.1 and iPadOS 16.6.1 This document describes the security content of iOS 16.6.1 and iPadOS 16.6.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

About the security content of macOS Ventura 13.5.2

About the security content of macOS Ventura 13.5.2 This document describes the security content of macOS Ventura 13.5.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

About the security content of watchOS 9.6.2

About the security content of watchOS 9.6.2 This document describes the security content of watchOS 9.6.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

PT-2023-23948

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description The issue is related to an incorrect authorization check in SQLLab, allowing an authenticated user to query tables they do not have proper access to. This can be exploited by...

agent-actors (=0.1.0), agent-lab-sdk (>=0.1.7 <=0.1.16) +249 more potentially affected by CVE-2023-39631 via langchain (>=0.0.100 <=0.0.306)

langchain PYPI version =0.0.100, =0.1.7, =0.2.1, =0.1.0, =0.1.5, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.5, =0.0.14, =0.1.9, =0.0.33, =0.0.40 and more Source cves: CVE-2023-39631 Source advisory: OSV:GHSA-F73W-4M7G-CH9X...

Tinycontrol LAN Controller v3 (LK3) Remote Admin Password Change

Summary Lan Controller is a very universal device that allows you to connect many different sensors and remotely view their readings and remotely control various types of outputs. It is also possible to combine both functions into an automatic if - this with a calendar when - then. The device...

Malicious code in @intact-lab/ngx-iceberg-links (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55d4c2e5564fb8d843d5672f7952d370ab93e26d7c031567fc4db522c21ce0b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7926 Malicious code in @intact-lab/ngx-iceberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63ed3b552a74f73b31973f3f5a4a21e344617adcaef85804c109a61a1956facc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

effata-lab.it Cross Site Scripting vulnerability OBB-3621070

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...