Citrix Releases Security Updates for NetScaler ADC and Gateway

Citrix has released security updates to address vulnerabilities CVE-2023-3519, CVE-2023-3466, and CVE-2023-3467 affecting NetScaler ADC and NetScaler Gatewaylink is external. An attacker can exploit one of these vulnerabilities to take control of an affected system. According to Citrix,...

PT-2023-11654 · Unknown · Advancemame

Name of the Vulnerable Software and Affected Versions: AdvanceMAME versions through 2.1 Description: The issue is a heap-based buffer over-read in the png convert 4 function, located in the pngex.cc file. This occurs in AdvanceMAME. Recommendations: For AdvanceMAME versions through 2.1, update to...

EulerOS 2.0 SP10 : glib2 (EulerOS-SA-2023-2381)

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Rejected reason: Rejected by upstream. CVE-2023-24593, CVE-2023-25180 Note that Tenable Network Security has extracted the preceding description...

EulerOS 2.0 SP10 : glib2 (EulerOS-SA-2023-2355)

According to the versions of the glib2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Rejected reason: Rejected by upstream. CVE-2023-24593, CVE-2023-25180 Note that Tenable Network Security has extracted the preceding description...

vm2 End of Life (EOL) Detection

The vm2 version on the remote host has reached the end of life EOL and should not be used anymore. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Fedora 38 : java-1.8.0-openjdk (2023-cccfdd62d2)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-cccfdd62d2 advisory. feature complete repack of jdk8 portable Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Base plugin Gstreamer Code Execution

The vulnerability of the Base plugin gst-plugins-base in the Gstreamer multimedia framework is related to insufficient protection of service data due to the lack of security updates on the remote host. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected...

PT-2023-25739 · Admidio · Admidio

Name of the Vulnerable Software and Affected Versions: admidio/admidio versions prior to 4.2.10 Description: The issue concerns an unrestricted upload of files with dangerous types. This could potentially allow attackers to upload malicious files, posing a security risk. Recommendations: For...

Security Updates for Microsoft Office Products (May 2023) (macOS)

The version of Microsoft Office for Mac installed on the remote host is affected by multiple remote code execution vulnerabilities as referenced in the may-16-2023 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version...

Juniper Releases Multiple Security Updates for Juno OS

Juniper has released updates to address multiple vulnerabilities in Juno OSlink is external. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Juniper’s Support Portallink is external and apply the...

Microsoft’s July 2023 Patch Tuesday Addresses 5 Zero-day Vulnerabilities

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Microsofts July 2023 Patch Tuesday includes security updates for 130 flaws, including five actively exploited zero-day vulnerabilities, nine are rated as Critical’, and 37 remote code execution...

Vulnerabilities fixed in Citrix Secure Access Clients

Citrix has fixed vulnerabilities in the Secure Access Client for Windows and Ubuntu. The vulnerability with reference CVE-2023-24491 is located in the Windows client and allows a local malicious person to grant themselves elevated privileges and execute code with privileges of SYSTEM The...

Vulnerabilities fixed in Adobe InDesign

Adobe has fixed vulnerabilities in InDesign. A malicious person could exploit the vulnerabilities to gain access to system data, or to execute arbitrary code with permissions of the user. To exploit the vulnerabilities, the malicious party needs local access to the application, or needs to trick ...

Fedora 38 : mingw-nsis (2023-dfb6cc599f)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-dfb6cc599f advisory. Update to 3.09, fixes CVE-2023-37378. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Security Updates for Microsoft Excel Products C2R (July 2023)

The Microsoft Excel Products are missing a security update. It is, therefore, affected by multiple vulnerabilities, as follows: - Two remote code execution vulnerabilities. CVE-2023-33161, CVE-2023-33158 - An information disclosure vulnerability. CVE-2023-33162 Note that Nessus has not tested for...

Security Updates for Microsoft Office Products (July 2023) (macOS)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, In...

Security Updates for Microsoft Dynamics 365 (on-premises) (July 2023)

The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote attacker can craft a specially-constructed URL which, when accessed by an authorised user, allows the attacker to retrieve cookies, present the user with a dialog...

Adobe Releases Security Updates for ColdFusion and InDesign

Adobe has released security updates to address vulnerabilities affecting ColdFusionlink is external and InDesignlink is external. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Adobe security...

Guidance on Microsoft Signed Drivers Being Used Maliciously

Executive Summary: Microsoft was recently informed that drivers certified by Microsoft’s Windows Hardware Developer Program MWHDP were being used maliciously in post-exploitation activity. In these attacks, the attacker gained administrative privileges on compromised systems before using the...

Microsoft Guidance for Addressing Security Feature Bypass in Trend Micro EFI Modules

Trend Micro has released CVE-2023-28005 to address a secure boot bypass. Subsequently Microsoft has released the July Windows security updates to block the vulnerable UEFI modules by using the DBX UEFI Secure Boot Forbidden Signature Database disallow list. To exploit this vulnerability, an...