A Bootiful Podcast: Java Language Architect Brian Goetz

Hi, Spring fans! Are you using Java 21 in production already? No? you should listen to this episode. Yes? Then you should listen to this episode! This week, Josh Long talks to legendary Java Language Architect Brian Goetz @BrianGoetz recaping the latest-and-greatest and previewing Java.next...

Important: Red Hat Security Advisory: nodejs security, bug fix, and enhancement update

An update for nodejs is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Oracle VirtualBox: Multiple Vulnerabilities

Background VirtualBox is a powerful virtualization product from Oracle. Description Multiple vulnerabilities have been discovered in Oracle VirtualBox, the worst of which may lead to VirtualBox compromise by an attacker with network access. Please review the CVE identifiers referenced below for...

Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

Update your browser: Security fix for latest Chrome zero-day

News, Security Update your browser: Security fix for latest Chrome zero-day Share September 29th, 2023 Hi everyone! Opera browsers have received important updates addressing a number of vulnerabilities and bugs. Among those is the following zero-day vulnerability detected by security researchers,...

CVE-2023-42807 Frappe LMS SQL Injection Issue on People Page

Frappe LMS is an open source learning management system. In versions 1.0.0 and prior, on the People Page of LMS, there was an SQL Injection vulnerability. The issue has been fixed in the main branch. Users won't face this issue if they are using the latest main branch of the app...

PT-2023-8671 · Intel · Intel Qat Software Drivers

Name of the Vulnerable Software and Affected Versions: IntelR QAT software drivers for Windows versions prior to QAT1.7-W-1.11.0 Description: The issue is related to an out-of-bounds read in some IntelR QAT software drivers for Windows, which may allow an authenticated user to potentially enable...

CVE-2023-41055 LibreY Server-Side Request Forgery (SSRF) vulnerability via wikipedia_language cookie

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery SSRF vulnerability in the engines/google/text.php and engines/duckduckgo/text.php files in versions before commit...

CVE-2023-41054 LibreY Server-Side Request Forgery (SSRF) vulnerability in image_proxy.php

LibreY is a fork of LibreX, a framework-less and javascript-free privacy respecting meta search engine. LibreY is subject to a Server-Side Request Forgery SSRF vulnerability in the imageproxy.php file of LibreY before commit 8f9b9803f231e2954e5b49987a532d28fe50a627. This vulnerability allows remo...

Festo LX Appliance

SUMMARY A vulnerability in the Video.js package could allow a user of LX Appliance, with a high privilege account i.e., with the "Teacher" role, to craft a malicious course and launch an XSS attack. 2. REMEDIATION Contact Festo Didactic services department at [email protected] to...

Fedora 38 : java-latest-openjdk (2023-469d0d1a18)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-469d0d1a18 advisory. updated to July security update 20.0.2.9 portables Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Fedora 37 : java-latest-openjdk (2023-ba53233477)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ba53233477 advisory. updated to July security update 20.0.2.9 portables Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Fedora 38 : java-latest-openjdk-portable (2023-b7f6f0f77e)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b7f6f0f77e advisory. Update to jdk-20.0.2+9 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Exploit for Improper Input Validation in Lexmark Cxtpc_Firmware

CVE-2023-34362 POCs for credential dumping, reverse shells, an...

Soketi was exposed to Sandbox Escape vulnerability via vm2

Impact What kind of vulnerability is it? Who is impacted? Anyone who might have used Soketi with the cluster driver or through PM2. Patches Has the problem been patched? What versions should users upgrade to? Get the latest version of Soketi. Workarounds Is there a way for users to fix or remedia...

Ivanti Endpoint Manager Mobile < 11.3 Remote Unauthenticated API Access (CVE-2023-35082)

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is 11.3. It is, therefore, affected by an undisclosed unauthenticated API access vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the service's...

RosarioSIS 10.8.4 - CSV Injection Vulnerability

Exploit Title: RosarioSIS 10.8.4 - CSV Injection Exploit Author: Ranjeet Jaiswal Vendor Homepage: https://www.rosariosis.org/ Software Link: https://gitlab.com/francoisjacquet/rosariosis/-/archive/v10.8.4/rosariosis-v10.8.4.zip Affected Version: 10.8.4 Category: WebApps Tested on: Windows 10 1...

PT-2023-8504 · Qnap · Qnap Qts +2

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.3.2578 build 20231110 QNAP QuTS hero versions prior to h5.1.3.2578 build 20231110 QNAP QuTScloud versions prior to c5.1.5.2651 Description: An OS command injection issue affects QNAP operating system versions,...

Design/Logic Flaw

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passe...

CVE-2023-36466 Topic Title Validation Skipped When Changing Category in Discourse

Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic title validations for things like title length, number of emojis in title and blank topic titles. The issue is patched in the latest stable, beta and tests-passe...