CVE-2023-38706 Discourse vulnerable to DoS via drafts

Discourse is an open-source discussion platform. Prior to version 3.1.1 of the stable branch and version 3.2.0.beta1 of the beta and tests-passed branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server...

OESA-2023-1651 batik security update

Batik is an inline templating engine for CoffeeScript, inspired by CoffeeKup, that lets you write your template directly as a CoffeeScript function. Security Fixes: Server-Side Request Forgery SSRF vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru the jar protoco...

Avoid These 5 IT Offboarding Pitfalls

Employee offboarding is no one's favorite task, yet it is a critical IT process that needs to be executed diligently and efficiently. That's easier said than done, especially considering that IT organizations have less visibility and control over employees' IT use than ever. Today, employees can...

CVE-2023-42503 Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed...

Simplr Registration Form Plus+ <= 2.4.5 - Subscriber+ Arbitrary User Password Change via IDOR

Description The plugin is vulnerable to Insecure Direct Object References in versions up to, and including, 2.4.5. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for authenticated...

The vulnerability of the Cisco Application Policy Infrastructure Controller, related to the improper assignment of permissions to critical resources, allows a perpetrator to read, modify, or delete access policies for arbitrary users.

The vulnerability of the Cisco Application Policy Infrastructure Controller in the information infrastructure management system is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability allows a malicious actor to remotely read, modify, or delete...

CVE-2023-4213

CVE-2023-4213 concerns the WordPress plugin Simplr Registration Form Plus+ (up to version 2.4.5). The vulnerability is an Insecure Direct Object Reference (IDOR) that lets an authenticated user with subscriber-level permissions or higher access objects controlled by the user, bypass authorization...

PT-2023-5471

Name of the Vulnerable Software and Affected Versions .NET Core and Visual Studio affected versions not specified Description The issue is related to a Denial of Service vulnerability in .NET Core and Visual Studio. It involves an uncontrolled consumption of resources. Exploitation of this issue...

Fiber Security Breach

Fiber is an open source web framework written in the Go language. A security vulnerability exists in Fiber versions prior to 2.49.1 that stems from not properly restricting access to localhost, which could allow an unauthorized attacker to access resources supplied to the localhost only...

Oracle Linux 8 : libreoffice (ELSA-2020-1598)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1598 advisory. - Resolves: rhbz1743958 CVE-2019-9849, etc. Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Not...

Oracle Linux 7 : libreoffice (ELSA-2020-1151)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1151 advisory. - Resolves: rhbz1743962 CVE-2019-9848 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Important: clamav

Issue Overview: A vulnerability in the filesystem image parser for Hierarchical File System Plus HFS+ of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to an incorrect check for completion when a...

How to find ICA Gateway accessing log in nslog

This article is an analysis on nslog /var/log/ns.log for accessing CVAD environment via ICA gateway. However, nslog will not include detailed logs for this process. Please refer to analysis on "NetScaler Gateway+StoreFront+XenDesktop workflow" in the article in additional resources...

The vulnerability of the Lightweight HTTP Server component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows a attacker to induce a service failure.

The vulnerability of the Lightweight HTTP Server component of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine is related to unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2023-28366

A memory leak vulnerability was found in Eclipse Mosquitto. This issue is triggered by malicious initial packets or certain client actions and may allow a remote attacker to the deplete system resources causing memory exhaustion, leading to a disruption in services and a denial of service conditi...

Xxe

IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 258786...

The vulnerability of the ImageIO component in the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition virtual machine allows a hacker to trigger a service failure.

The vulnerability of the ImageIO component in Oracle Java SE and the Oracle GraalVM Enterprise Edition software platform is related to unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Supply Chain Security Leaders Collaborate to Help Developers Choose Open-Source

Supply Chain Security Leaders Collaborate to Help Developers Choose Open-Source By Trellix, Checkmarx and Illustria · September 05, 2023 Working together to keep open source safe At the beginning of 2023, top researchers from industry-leading companies established the Supply Chain Attack Research...

The vulnerability in the driver/char/xillybus/xilliusb.c component of the Linux operating system allows a hacker to increase their privileges within the system.

The vulnerability in the driver/char/xillybus/xilliusb.c component of the Linux operating system is related to the simultaneous use of a shared resource with incorrect synchronization. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2023-35892

CVE-2023-35892 affects IBM Financial Transaction Manager for SWIFT Services 3.2.4 and is an XML External Entity Injection (XXE) vulnerability in XML processing. Multiple sources confirm the affected product/version and localized impacts: exposure of sensitive data, potential memory consumption, w...