CVE-2023-49944

The Challenge Response feature of BeyondTrust Privilege Management for Windows PMfW before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature...

CVE-2023-49944

BeyondTrust Privilege Management for Windows (PMfW) versions prior to 2023-07-14 contain a vulnerability in the Challenge Response feature that allows local admins to bypass the protection by decrypting the shared key or locating the decrypted key in process memory. The threat is mitigated by ena...

CVE-2023-51451

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...

CVE-2023-51451

CVE-2023-51451 concerns Symbolicator (used with Sentry). Affects Symbolicator versions 0.3.3 up to 21.12.1; an attacker could cause Symbolicator to issue GET requests to arbitrary URLs with internal IPs by exploiting an invalid protocol. Responses could be exposed via the Symbolicator API/UI in a...

CVE-2023-51451 SSRF in symbolicator via invalid protocol

Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via...

kernel security update

5.14.0-362.13.1.el93.OL9 - x86/retpoline: Document some thunk handling aspects Borislav Petkov CVE-2023-20569 - objtool: Fix return thunk patching in retpolines Josh Poimboeuf CVE-2023-20569 - x86/srso: Remove unnecessary semicolon Yang Li CVE-2023-20569 - x86/calldepth: Rename x86returnskl to...

CVE-2023-42465

A flaw was found in the sudo package. This issue could allow a local authenticated attacker to cause a bit to flip, which enables fault injection and may authenticate as the root user. Mitigation In general to address this issue, it's crucial to implement robust logic that prevents unintended...

Security Bulletin: IBM Storage Fusion HCI may be vulnerable to denial of service due to Pallets Werkzeug (CVE-2023-46136)

Summary The python library Pallets Werkzeug is used by IBM Storage Fusion HCI's backup and restore function for WSGI utilities. A vulnerability in this library could lead to Denial of Service as described the CVE listed in the "Vulnerability Details" section. Vulnerability Details...

Security Bulletin: IBM Storage Fusion HCI may be vulnerable to denial of service due to jackson-databind, okio (CVE-2022-42003, CVE-2023-35116, CVE-2023-3635)

Summary Java libraries jackson-databind and okio are used by IBM Storage Fusion HCI for logging. Vulnerabilities in these libraries could lead to Denial of Service as described the the CVEs listed in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION:...

GHSA-8F57-WCMG-4JMH Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

CVE-2023-47265

Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. This Javascript can be executed on the client side of any of the user who looks at the tasks in the...

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection and accept HID keyboard reports potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue.

...

QNAP VioStor NVR

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor : QNAP Equipment : VioStor NVR Vulnerability : OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability...

FXC AE1021/AE1021PE

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor : FXC Equipment : AE1021, AE1021PE Vulnerability : OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability...

liquidatePosition() change LOAN_TERM may result in the borrower paying additional liquidation fees.

Lines of code Vulnerability details Vulnerability details Currently, there are three ways to close a position: 1. The borrower voluntarily closes it through closePosition. 2. If Premium is insufficient, it is forcibly closed by liquidatePosition. 3. After the loan expires, LP forcibly closes it b...

Lack of receive() inside MoneyMarketHook contract when interacting with WNATIVE.

Lines of code Vulnerability details Impact MoneyMarketHook is expected to work with the native balance when interacting with WNATIVE, especially when params.returnNative is set to true during the execute operation. However, due to the lack of a receive function inside the contract, MoneyMarketHoo...

Api3OracleReader may be unavailable up to 1 hour if the timestamp of the price from the Api3Server is bigger than the current block.timestamp

Lines of code Vulnerability details Impact Oracle unavailable for up to 1 hour, which could lead to positions going underwater and being liquidated when it becomes live again, without users having the chance to repay/collateralize. Proof of Concept The airnode code has a note concerning this...

An artPiece with a creator address set to address(0) leads to a pseudo-permanent DoS if it ends up being auctioned.

Lines of code Vulnerability details Vulnerability details Description There is a potential for a DoS in the AuctionHouse contract related to the buyToken call from the ERC20TokenEmitter. This is due to the buyToken using the mint function to all the addresses that are stored on the creators array...

Input Validation for createPiece Function

Lines of code Vulnerability details Potential Risk: The createPiece function in the CultureIndex contract takes two parameters: metadata and creatorArray. While the function calls the validateCreatorsArray and validateMediaType functions to validate the input data, it does not verify whether the...

Input Validation for 'createBid' Function

Lines of code Vulnerability details Potential Risk: The 'createBid' function in the contract is responsible for allowing users to place bids on a Verb auction by sending Ether. While the function includes several checks, it lacks explicit input validation for certain parameters, which could lead ...