PT-2023-20373 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS version 9.5.0.0 Description: The issue is related to improper link resolution before file access in the isi gather info function. A local attacker, potentially with low privileges, could exploit this, leading to system...

Medium: dbus

Issue Overview: An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with certain invalid type signatures. CVE-2022-42010 An...

curl: CVE-2023-28320: siglongjmp race condition

A race condition vulnerability existed in libcurl's siglongjmp call when using the USEALARMTIMEOUT codepath for DNS resolution. If two threads performed DNS resolving, a wrong register context could be used on the signal handler siglongjmp call if DNS timeout occurred, resulting in a segmentation...

PT-2023-17194

Name of the Vulnerable Software and Affected Versions Infoline Project Management System versions prior to 4.09.31.125 Description The issue is a Server-Side Request Forgery SSRF vulnerability in the Infoline Project Management System, allowing Server Side Request Forgery. Recommendations For...

Samba AD DC "dnsHostname" attribute can be

Description In implementing the Validated dnsHostName permission check in Samba's Active Directory DC, and therefore applying correctly constraints on the values of a dnsHostName value for a computer in a Samba domain CVE-2022-32743, the case where the dnsHostName is deleted, rather than modified...

kernel security, bug fix, and enhancement update

5.14.0-162.22.21.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

CBL Mariner 2.0 Security Update: bind (CVE-2022-2795)

The version of bind installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-2795 advisory. - By flooding the target resolver with queries exploiting this flaw an attacker can significantly impair the...

Amazon Linux 2023 : php8.1, php8.1-bcmath, php8.1-cli (ALAS2023-2023-139)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-139 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the passwo...

Important: pesign

Issue Overview: A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script...

SUSE-SU-2023:0857-1 Security update for drbd

This update of drbd fixes the following issues: - rebuild the package with the new secure boot key bsc1209188...

Important: bind

Issue Overview: A cache poisoning vulnerability was found in BIND when using forwarders. Bogus NS records supplied by the forwarders may be cached and used by name if it needs to recurse for any reason. This issue causes it to obtain and pass on potentially incorrect answers. This flaw allows a...

Amazon Linux 2023 : bsdcat, bsdcpio, bsdtar (ALAS2023-2023-071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-071 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...

Open redirect

Rapid7 InsightVM versions 6.6.178 and lower suffers from an open redirect vulnerability, whereby an attacker has the ability to redirect the user to a site of the attacker’s choice using the ‘page’ parameter of the ‘data/console/redirect’ component of the application. This issue was resolved in t...

CVE-2023-28083 Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4).

A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 iLO 6, Integrated Lights-Out 5 iLO 5 and Integrated Lights-Out 4 iLO 4. HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out...

Fedora 37 : mingw-python-OWSLib (2023-8312a80917)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8312a80917 advisory. Update to OWSLib-0.28.1, fixes CVE-2023-27476. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 36 : mingw-python-OWSLib (2023-ae06b3704c)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ae06b3704c advisory. Update to OWSLib-0.28.1, fixes CVE-2023-27476. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

cilium-agent container can access the host via `hostPath` mount

Impact An attacker with access to a Cilium agent pod can write to /opt/cni/bin due to a hostPath mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the...

GHSA-9C6G-QPGJ-RVXW Streamlit publishes previously-patched Cross-site Scripting vulnerability

Synopsis: Streamlit open source publicizes a prior security fix implemented in 2021. The vulnerability affected Streamlit versions between 0.63.0 and 0.80.0 inclusive and was patched on April 21, 2021. If you are using Streamlit with version before 0.63.0 or after 0.80.0, no action is required. 1...

DEBIAN-CVE-2023-27585

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to...

CVE-2023-24577

McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a user with lower privileges to execute unauthorized tasks...