[SECURITY] Fedora 38 Update: linux-firmware-20230919-1.fc38

This package includes firmware files required for some devices to operate...

PT-2025-31032 · Unknown · Gix-Transport

Name of the Vulnerable Software and Affected Versions: gix-transport crate versions prior to 0.36.1 Description: The gix-transport crate contains a flaw that allows command execution through a crafted input string during a clone operation. Specifically, the vulnerability is triggered by the “gix...

CVE-2023-43144

Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php...

Oracle Linux 8 : open-vm-tools (ELSA-2023-5312)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5312 advisory. 12.1.5-2.0.2.3 - Resolves: RHEL-4584 CVE-2023-20900 open-vm-tools: SAML token signature bypass Tenable has extracted the preceding description block directly fr...

AlmaLinux 8 : open-vm-tools (ALSA-2023:5312)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:5312 advisory. - A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-...

Oracle Linux 9 : open-vm-tools (ELSA-2023-5313)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5313 advisory. 12.1.5-1.0.2.3 - Resolves: RHEL-4584 CVE-2023-20900 open-vm-tools: SAML token signature bypass Tenable has extracted the preceding description block directly fr...

open-vm-tools: SAML token signature bypass

An improper signature verification flaw was found in open-vm-tools that may lead to a bypass of SAML token signature. A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been...

Finnish Authorities Dismantle Notorious PIILOPUOTI Dark Web Drug Marketplace

Finnish law enforcement authorities have announced the takedown of PIILOPUOTI, a dark web marketplace that specialized in illegal narcotics trade since May 2022. "The site operated as a hidden service in the encrypted TOR network," the Finnish Customs aka Tulli said in a brief announcement on...

Amazon Linux 2 : open-vm-tools (ALAS-2023-2250)

The version of open-vm-tools installed on the remote host is prior to 12.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2250 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network...

Medium: opensc

Issue Overview: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decodebitstring in libopensc/asn1.c. CVE-2019-15945 OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1decodeentry in libopensc/asn1.c. CVE-2019-15946 An issue was...

Amazon Linux 2023 : open-vm-tools, open-vm-tools-desktop, open-vm-tools-devel (ALAS2023-2023-350)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-350 advisory. VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor with man-in-the- middle MITM network positioning between vCenter server and the virtual machine may be able to bypass...

Operation Rusty Flag: Azerbaijan Targeted in New Rust-Based Malware Campaign

Targets located in Azerbaijan have been singled out as part of a new campaign that's designed to deploy Rust-based malware on compromised systems. Cybersecurity firm Deep Instinct is tracking the operation under the name Operation Rusty Flag. It has not been associated with any known threat actor...

open-vm-tools: SAML token signature bypass

An improper signature verification flaw was found in open-vm-tools that may lead to a bypass of SAML token signature. A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been...

open-vm-tools: SAML token signature bypass

An improper signature verification flaw was found in open-vm-tools that may lead to a bypass of SAML token signature. A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been...

open-vm-tools: SAML token signature bypass

An improper signature verification flaw was found in open-vm-tools that may lead to a bypass of SAML token signature. A malicious actor that has been granted Guest Operation Privileges in a target virtual machine may be able to elevate their privileges if that target virtual machine has been...

Nats-Server Path Traversal Vulnerability

Nats-Server is a high-performance server for Nats.io, cloud and edge native messaging systems. A path traversal vulnerability exists in Nats-Server versions 2.2.0 through 2.7.4, which stems from a path from an administrative account to an administrative operation that is not as expected...

Oracle Linux 7 : open-vm-tools (ELSA-2023-5217)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-5217 advisory. 11.0.5-3.0.1 - fix spaces in vmware udev rule for scsi devices Orabug: 24461968 - Fix vmware udev rule in 99-vmware-scsi-timeout.rules file. Orabug: 22815019 -...

OESA-2023-1631 open-vm-tools security update

The project is an open source implementation of VMware Tools. It is a suite of open source virtualization utilities and drivers to improve the functionality, user experience and administration of VMware virtual machines. This package contains only the core user-space programs and libraries of...

Race condition

A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. This vulnerability is due to a time-of-check, time-of-use TOCTOU race condition when an install query regarding an ISO imag...

CVE-2023-20135

Cisco IOS XR Software image verification checks contain a TOCTOU race condition during ISO image install queries, enabling an authenticated, local attacker to execute arbitrary code on the device. Affected component: image verification logic in IOS XR. Root cause: TOCTOU between ISO image modific...