VulnCheck KEV: CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

GHSA-7M48-WC93-9G85 ASAR Integrity bypass via filetype confusion in electron

Impact This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS. Specifically this issue can only be exploited...

Dell Rugged Control Center Security Vulnerability

Dell Rugged Control Center is an application from Dell USA. It allows a range of settings to be configured on a ruggedized device, such as application settings, keyboard backlighting settings, night mode settings, stealth mode settings, window settings, antenna switch settings, and GPS settings. ...

CVE-2023-34389 Allocation of resources without limits could lead to denial of service

An allocation of resources without limits or throttling vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow a remote authenticated attacker to make the system unavailable for an indefinite amount of time. See product Instruction Manual Appendix A dated 20230830 for more...

Mattermost Denial of Service Vulnerability (CNVD-2023-9448711)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from an inability to limit the log size of server logs, which can be exploited by an attacker to consume excessive resources and cau...

Mattermost Denial of Service Vulnerability (CNVD-2023-9448306)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from an inability to properly limit the characters allowed in different fields of a block in Mattermost Boards, which can be exploit...

kernel: ice: Don't tx before switchdev is fully configured

In the Linux kernel, the following vulnerability has been resolved: ice: Don't tx before switchdev is fully configured There is possibility that iceeswitchportstartxmit might be called while some resources are still not allocated which might cause NULL pointer dereference. Fix this by checking if...

Server Side Request Forgery

google-translate-api-browser is vulnerable to Server Side Request Forgery. The vulnerability is due to improper sanitization of the translateOptions.tld field in the Google translate URL. If an application utilizing the package exposes the translateOptions to the end user, an attacker can set a...

capsule-proxy Authorization Issues Vulnerability

capsule-proxy is allowed to overcome the limitations of the Kubernetes API Server in listing the cluster-wide resources it owns, such as Namespace, Ingress and Storage Classes, Nodes, and other resources covered by Capsule. An authorization issue vulnerability exists in capsule-proxy version 0.4....

PT-2023-7472 · Unknown · Google-Translate-Api-Browser

Name of the Vulnerable Software and Affected Versions: google-translate-api-browser versions prior to 4.1.3 Description: A Server-Side Request Forgery SSRF issue is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An...

Chrome pushes forward with plans to limit ad blockers in the future

Google has announced it will shut down Manifest V2 in June 2024 and move on to Manifest V3, the latest version of its Chrome extension specification that has faced criticism for putting limits on ad blockers. Roughly said, Manifest V2 and V3 are the rules that browser extension developers have to...

Denial Of Service (DoS)

libsquid.so is vulnerable to Denial of Service DoS. The vulnerability occurs when an attacker sends a specially crafted HTTP Digest authentication request to a vulnerable Squid server. The request can cause the server to consume excessive CPU resources, leading to a DoS condition...

Synology Router Manager (SRM) 1.2.x < 1.2.5-8227-11, 1.3.x < 1.3.1-9346-8 Multiple Vulnerabilities (Synology-SA-23:16) - Remote Known Vulnerable Versions Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Dell Command | Monitor 安全漏洞

The Dell Command Monitor software application enables IT administrators to easily manage fleet inventory, monitor system operating conditions, modify BIOS settings, and remotely collect information from deployed Dell client systems. Proactive system health monitoring can help reduce total system...

Ubuntu: Security Advisory (USN-6506-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OpenHarmony has an unspecified vulnerability

OpenHarmony is a kind of hongmeng operating system open source project. A security vulnerability exists prior to OpenHarmony version v3.2.2, which can be exploited by an attacker to obtain sensitive buffer information by using uninitialized resources...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Apache HTTP Server vulnerabilities (USN-6506-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6506-1 advisory. David Shoon discovered that the Apache HTTP Server modmacro module incorrectly handled certain memory operations. A remote...

GHSA-2C7C-3MJ9-8FQH Decryption of malicious PBES2 JWE objects can consume unbounded system resources

The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service...

Microsoft named a Leader in 2023 Gartner® Magic Quadrant™ for Access Management for the 7th year​​

Protecting identity from compromise is top of mind for security professionals as identity attacks continue to intensify. Earlier this year we reported that we had observed a nearly three-fold increase in password attacks per second in the last two years, from 579 in 2021 to 4,000 in 2023.1 Identi...

When Maximum Effort Doesn't Equate to Maximum Results

It’s no secret that security teams are feeling beleaguered as a result of the barrage of data, events, and alerts generated by their security tools, to say nothing of the increased budget scrutiny and constrained staff resources that continue to plague cybersecurity practitioners. The trick is...