Attack Surface Management vs. Vulnerability Management

Attack surface management ASM and vulnerability management VM are often confused, and while they overlap, they're not the same. The main difference between attack surface management and vulnerability management is in their scope: vulnerability management checks a list of known assets, while attac...

SUSE-SU-2024:1072-1 Security update for the Linux Kernel (Live Patch 20 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-1504002497 fixes several issues. The following security issues were fixed: - CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unixstreamreadgenericon the socket that the SKB is queu...

SUSE-SU-2024:1053-1 Security update for the Linux Kernel (Live Patch 43 for SLE 15 SP2)

This update for the Linux Kernel 5.3.18-15020024183 fixes several issues. The following security issues were fixed: - CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unixstreamreadgenericon the socket that the SKB is queu...

SUSE-SU-2024:1045-1 Security update for the Linux Kernel (Live Patch 5 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005528 fixes several issues. The following security issues were fixed: - CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unixstreamreadgenericon the socket that the SKB is queu...

CVE-2024-2818

An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. It was possible for an attacker to cause a denial of service using malicious crafted description parameter for labels...

CVE-2023-6371

An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS advisories on March 26, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-086-01 Automation-Direct C-MORE EA9 HMI ICSA-24-086-02 Rockwell Automation PowerFlex 52...

PT-2024-23252 · Emacs +9 · Emacs +9

Name of the Vulnerable Software and Affected Versions: Emacs versions prior to 29.3 Description: The issue concerns how Gnus in Emacs handles inline MIME contents, treating them as trusted. This could potentially lead to security issues, although specific details about exploitation or affected...

openSUSE Security Advisory (SUSE-SU-2024:0870-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

phpmyfaq -- multiple vulnerabilities

phpMyFAQ team reports: The phpMyFAQ Team has learned of multiple security issues that'd been discovered in phpMyFAQ 3.2.5 and earlier. phpMyFAQ contains cross-site scripting XSS, SQL injection and bypass vulnerabilities...

USN-6707-1: Linux kernel vulnerabilities

Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...

ROS-2-988

2.988 Multiple Exim Server Vulnerabilities 1. Vulnerability description: CVE-2020-28007 A vulnerability in the Exim message forwarding agent, is related to a symbolic link in the Exim log directory. Exploitation of the vulnerability could allow an attacker to create a special symbolic link to a...

CISA Releases One Industrial Control Systems Advisory

CISA released one Industrial Control Systems ICS advisory on March 12, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-072-01 Schneider Electric EcoStruxure Power Design CISA encourages users and administrator...

March 12, 2024—KB5035854 (OS Build 22000.2836)

None None...

Hotfix update for Exchange Server 2019 and 2016: April 23, 2024 (KB5037224)

None None...

USN-6688-1: Linux kernel (OEM) vulnerabilities

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service host domain crash...

CISA Releases One Industrial Control Systems Advisory

CISA released one Industrial Control Systems ICS advisory on March 7, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-067-01 Chirp Systems Chirp Access CISA encourages users and administrators to review the...

SUSE-SU-2024:0785-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2023-40217: Fixed bypass TLS handshake on closed sockets bsc1214692. - CVE-2023-6597: Fixed symlink bug in cleanup bsc1219666...

BIT-NODE-2023-30590

The generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet, but the function is also needed to compute the corresponding public key after calling setPrivateKey. However, the...

Artica Proxy 4.50 Loopback Service Disclosure Vulnerability

Services that are running and bound to the loopback interface on the Artica Proxy version 4.50 are accessible through the proxy service. In particular, the tailon service is running as the root user, is bound to the loopback interface, and is listening on TCP port 7050. Using the tailon service,...