[SECURITY] [DSA 5703-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5703-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 02, 2024 https://www.debian.org/security/faq -...

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)

Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest...

[SECURITY] [DSA 5693-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5693-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 17, 2024 https://www.debian.org/security/faq -...

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 6, 2024 to May 12, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 184 vulnerabilities disclosed in 146 WordPres...

Improper Access Control

Postorius is vulnerable to Improper Access Control. The vulnerability is due to insufficient validation which allows any logged-in user to send a crafted POST request to unsubscribe any user from a mailing list as well as verify if the address was subscribed in the first place...

[SECURITY] [DSA 5670-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5670-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 22, 2024 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5657-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5657-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 12, 2024 https://www.debian.org/security/faq -...

Wordfence Intelligence Weekly WordPress Vulnerability Report (March 25, 2024 to March 31, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 405 vulnerabilities disclosed in 320 WordPres...

[SECURITY] [DSA 5651-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5651-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 31, 2024 https://www.debian.org/security/faq -...

Cilium has insecure IPsec transport encryption

Impact Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to the following attacks by a man-in-the-middle attacker: - Chosen plaintext attacks - Key recovery attacks -...

Unencrypted traffic between nodes when using WireGuard and L7 policies

Impact In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies: - Traffic that should be WireGuard-encrypted is sent unencrypted between a node's Envoy proxy and pods on other nodes. - Traffic that should be WireGuard-encrypted is sent unencrypted between a node's DNS prox...

Unencrypted traffic between nodes when using IPsec and L7 policies

Impact In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies: - Traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted - Traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent...

CVE-2023-40160

Directory traversal vulnerability exists in Mailing List Search CGI pmmls.exe included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server...

CVE-2023-40160

Directory traversal vulnerability exists in Mailing List Search CGI pmmls.exe included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server...

CVE-2023-40160

CVE-2023-40160 involves a directory traversal in the Mailing List Search CGI (pmmls.exe) of A.K.I Software PMailServer/PMailServer2. The vulnerability may allow a remote attacker to obtain arbitrary files on the server. Affected CGI is pmmls.exe (and related PMailServer/PMailServer2 components). ...

PT-2024-12861 · A.K.I · Pmailserver +1

Name of the Vulnerable Software and Affected Versions: A.K.I Software's PMailServer/PMailServer2 products affected versions not specified Description: A directory traversal vulnerability exists in the Mailing List Search CGI pmmls.exe included in the products. This vulnerability can be exploited ...

Unencrypted traffic between pods when using Wireguard and an external kvstore

Impact For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. Patches This issue affects Cilium v1.14 before v1.14.7. This issue has been patched in Cilium v1.14.7. Workarounds There is no workarou...

GHSA-7496-FGV9-XW82 Unencrypted ingress/health traffic when using Wireguard transparent encryption

Impact For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The heal...

Unencrypted ingress/health traffic when using Wireguard transparent encryption

Impact For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The heal...

[SECURITY] [DSA 5608-1] gst-plugins-bad1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5608-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 27, 2024 https://www.debian.org/security/faq -...