13668 matches found
CVE-2023-27591
CVE-2023-27591 affects Miniflux prior to v2.0.43. An unauthenticated user could retrieve Prometheus metrics from a publicly reachable Miniflux instance when the metrics collector is enabled and METRICS_ALLOWED_NETWORKS is set to 127.0.0.1/8 (default). A patch is available in Miniflux v2.0.43. Wor...
RLSA-2023:1252 Important: nss security update
Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fixes: nss: Arbitrary memory write via PKCS 12 CVE-2023-0767 For more details about the security issues, including the impact, a CVSS...
Design/Logic Flaw
OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.9 and 3.2.6, if dsisinlist is used with an invalid IP address string NULL is illegal input, OpenSIPS will attempt to print a string from a random address stack garbage, which could lead to a crash. All user...
Array Networks APV products 命令注入漏洞
Array Networks APV products are a family of array load balancing and application delivery products from Array Networks, Inc. provides the availability, scalability, performance, security, and control necessary to keep applications running in their power band. A security vulnerability exists in...
The vulnerability of the Fortinet FortiNAC network access control mechanism lies in its lack of proper access control mechanisms, allowing attackers to increase their privileges.
The vulnerability of the Fortinet FortiNAC network access control device is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
ALSA-2023:1252 Important: nss security update
Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Security Fixes: nss: Arbitrary memory write via PKCS 12 CVE-2023-0767 For more details about the security issues, including the impact, a CVSS...
Microsoft Defender for Cloud Management Port Exposure Confusion
Prior to March 9, 2023, Microsoft Defender for Cloud incorrectly marked some Azure virtual machines as having secured management ports including SSH port 22/TCP, RDP port 3389/TCP and WINRM port 5985/TCP, when in fact one or more of these ports were exposed to the internet. This occured when the...
Attack Superhighway: A Deep Dive on Malicious DNS Traffic
...
CVE-2023-0021
CVE-2023-0021 affects SAP NetWeaver versions 700–750. It stems from insufficient encoding of user input, allowing an unauthenticated attacker to inject code that can expose sensitive data (e.g., user IDs and passwords) and may lead to reflected Cross-Site Scripting. Endpoints are network-exposed,...
[SECURITY] Fedora 36 Update: dcmtk-3.6.7-3.fc36
DCMTK is a collection of libraries and applications implementing large parts the DICOM standard. It includes software for examining, constructing and converting DICOM image files, handling offline media, sending and receiving images over a network connection, as well as demonstrative image storag...
Another Malware with Persistence
Heres a piece of Chinese malware that infects SonicWall security appliances and survives firmware updates. On Thursday, security firm Mandiant published a report that said threat actors with a suspected nexus to China were engaged in a campaign to maintain long-term persistence by running malware...
New Critical Flaw in FortiOS and FortiProxy Could Give Hackers Remote Access
Fortinet has released fixes to address 15 security flaws, including one critical vulnerability impacting FortiOS and FortiProxy that could enable a threat actor to take control of affected systems. The issue, tracked as CVE-2023-25610, is rated 9.3 out of 10 for severity and was internally...
EulerOS 2.0 SP5 : dhcp (EulerOS-SA-2023-1498)
According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ISC DHCP 4.4.0 - 4.4.3, ISC DHCP 4.1-ESV-R1 - 4.1-ESV-R16-P1, when the function optioncodehashlookup is called from addoption, it increases the...
EulerOS 2.0 SP5 : dnsmasq (EulerOS-SA-2023-1499)
According to the versions of the dnsmasq packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in dnsmasq in versions before 2.85. When configured to use a specific server for a given network interface, dnsmasq uses a fix...
EulerOS 2.0 SP9 : kernel (EulerOS-SA-2023-1488)
According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A vulnerability classified as critical was found in Linux Kernel Operating System affected version unknown. Affected by this vulnerability is so...
Fortinet FortiOS 路径遍历漏洞
Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content filtering, and antispam, etc. SSL...
EulerOS 2.0 SP11 : libarchive (EulerOS-SA-2023-1426)
According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the...
Zero Day Threat Protection for Your Network
Explore the world of zero day threats and gain valuable insight into the importance of proactive detection and remediation...
GHSA-J3RG-3RGM-537H Directus vulnerable to Server-Side Request Forgery On File Import
Summary Directus versions =9.22.4 is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls that were implemented to patch vulnerability CVE-2022-23080 by performing a DNS rebinding attack a...