Cilium has insecure IPsec transport encryption

Impact Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to the following attacks by a man-in-the-middle attacker: - Chosen plaintext attacks - Key recovery attacks -...

Unencrypted traffic between nodes when using WireGuard and L7 policies

Impact In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies: - Traffic that should be WireGuard-encrypted is sent unencrypted between a node's Envoy proxy and pods on other nodes. - Traffic that should be WireGuard-encrypted is sent unencrypted between a node's DNS prox...

Unencrypted traffic between nodes when using IPsec and L7 policies

Impact In Cilium clusters with IPsec enabled and traffic matching Layer 7 policies: - Traffic that should be IPsec-encrypted between a node's Envoy proxy and pods on other nodes is sent unencrypted - Traffic that should be IPsec-encrypted between a node's DNS proxy and pods on other nodes is sent...

CVE-2023-40160

Directory traversal vulnerability exists in Mailing List Search CGI pmmls.exe included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server...

CVE-2023-40160

Directory traversal vulnerability exists in Mailing List Search CGI pmmls.exe included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerability is exploited, a remote attacker may obtain arbitrary files on the server...

CVE-2023-40160

CVE-2023-40160 involves a directory traversal in the Mailing List Search CGI (pmmls.exe) of A.K.I Software PMailServer/PMailServer2. The vulnerability may allow a remote attacker to obtain arbitrary files on the server. Affected CGI is pmmls.exe (and related PMailServer/PMailServer2 components). ...

PT-2024-12861 · A.K.I · Pmailserver +1

Name of the Vulnerable Software and Affected Versions: A.K.I Software's PMailServer/PMailServer2 products affected versions not specified Description: A directory traversal vulnerability exists in the Mailing List Search CGI pmmls.exe included in the products. This vulnerability can be exploited ...

Unencrypted traffic between pods when using Wireguard and an external kvstore

Impact For Cilium users who have enabled an external kvstore and Wireguard transparent encryption, traffic between pods in the affected cluster is not encrypted. Patches This issue affects Cilium v1.14 before v1.14.7. This issue has been patched in Cilium v1.14.7. Workarounds There is no workarou...

GHSA-7496-FGV9-XW82 Unencrypted ingress/health traffic when using Wireguard transparent encryption

Impact For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The heal...

Unencrypted ingress/health traffic when using Wireguard transparent encryption

Impact For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, responses from pods to the Ingress and health endpoints are not encrypted. Traffic from the Ingress and health endpoints to pods is not affected by this issue. The heal...

[SECURITY] [DSA 5608-1] gst-plugins-bad1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5608-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso January 27, 2024 https://www.debian.org/security/faq -...

GHSA-P5F8-QF24-24CJ Velocity execution without script right through tree macro

Impact It's possible to execute a Velocity script without script right through the document tree. To reproduce: As a user without script right, create a document, e.g., named Nasty Title Set the document's title to $request.requestURI Click "Save & View" Reload the page in the browser The...

[SECURITY] [DSA 5579-1] freeimage security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5579-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 17, 2023 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5577-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5577-1 [email protected] https://www.debian.org/security/ Andres Salomon December 13, 2023 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5576-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5576-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 13, 2023 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5573-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5573-1 [email protected] https://www.debian.org/security/ Andres Salomon December 09, 2023 https://www.debian.org/security/faq -...

BlossomThemes Email Newsletter < 2.2.5 - Missing Authorization

Description The BlossomThemes Email Newsletter plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the btengetmailinglist function in versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to obtain a mailing...

VulnCheck KEV: CVE-2020-11546

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 30, 2023 to November 5, 2023)

Wordfence just launched its bug bounty program. Over the next 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now! Last week, there were 79 vulnerabilities disclosed in 64 WordPress Plugins and no WordPress themes that have been added to the Wordfence...

[SECURITY] [DSA 5551-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5551-1 [email protected] https://www.debian.org/security/ Andres Salomon November 09, 2023 https://www.debian.org/security/faq -...