Debian: Security Advisory (DLA-572-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-1223-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:0637-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040022 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed use-after-free in l2capcore.c of the Bluetooth component bsc1206314. - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits bsc1207139...

PT-2023-35415 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.12 Description: The issue concerns the initialization of the zlib workspace in btrfs. It has been noted that the zlib workspace is not properly zero-initialized, which may potentially lead to security issue...

Grafana vulnerable to Stored Cross-site Scripting in Text plugin

Description On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text". The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to...

CVE-2023-1065

This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploi...

CVE-2023-1065

This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obfuscate other, relevant, security issues. It does not expose the user of the integration to any direct security risk and no user data can be leaked. To exploi...

SUSE-SU-2023:0578-1 Security update for the Linux Kernel (Live Patch 20 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-1503005976 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed use-after-free in l2capcore.c of the Bluetooth component bsc1206314. - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits bsc1207139...

PT-2023-16732 · Snyk · Snyk Kubernetes Monitor

Name of the Vulnerable Software and Affected Versions: Snyk Kubernetes Monitor affected versions not specified Description: This issue can result in irrelevant data being posted to a Snyk Organization, potentially obfuscating other relevant security issues. It does not expose users to direct...

SUSE-SU-2023:0547-1 Security update for the Linux Kernel (Live Patch 16 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-1503005960 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed use-after-free in l2capcore.c of the Bluetooth component bsc1206314. - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits bsc1207139...

USN-5893-1: WebKitGTK vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

SUSE-SU-2023:0522-1 Security update for the Linux Kernel (Live Patch 26 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059101 fixes several issues. The following security issues were fixed: - CVE-2022-3564: Fixed use-after-free in l2capcore.c of the Bluetooth component bsc1206314. - CVE-2023-0179: Fixed incorrect arithmetics when fetching VLAN header bits bsc1207139...

Cisco NX-OS Software SSH X.509v3 Certificate Authentication with Unsupported Remote Authorization Method Privilege Escalation Issues

For certain products that are running Cisco NX-OS Software and are configured for SSH authentication with an X.509 version 3 X.509v3 certificate, two remote authorization methods are unsupported and could allow for privilege escalation: TACACS+ and certain configurations of Lightweight Directory...

K14649763: Overview of F5 vulnerabilities (August 2022)

Security Advisory Description On August 3, 2022, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associated...

K58581302: Archive_Tar vulnerabilities CVE-2020-28948 and CVE-2020-28949

Security Advisory Description CVE-2020-28948 ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. CVE-2020-28949 ArchiveTar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack...

K40084114: Overview of F5 vulnerabilities (January 2022)

Security Advisory Description On January 19, 2022, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...

Authorization vs. Intent: Why You Should Always Verify Both

The Wordfence Threat Intelligence team has observed a recent increase in the number of partial vulnerability patches that don’t properly address separate underlying issues. More specifically, we have been seeing an increase in Missing Authorization vulnerabilities that are fixed using tools...

SUSE: Security Advisory (SUSE-SU-2023:0455-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CISA Releases Two Industrial Control Systems Advisories

CISA released two 2 Industrial Control Systems ICS advisories on February 21, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...

CVE-2023-25570

Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers ma...