RHEL 8 : webkit2gtk3 (RHSA-2023:3433)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3433 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: a use-after-free when...

AlmaLinux 8 : webkit2gtk3 (ALSA-2023:3433)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:3433 advisory. - An out-of-bounds read was addressed with improved input validation. CVE-2023-28204 - A use-after-free issue was addressed with improved memory managemen...

RHEL 8 : kpatch-patch (RHSA-2023:3431)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3431 advisory. This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel...

RHEL 9 : webkit2gtk3 (RHSA-2023:3432)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3432 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: webkitgtk: a use-after-free when...

virt:kvm_utils2 security update

hivex libguestfs libguestfs-winsupport libiscsi libnbd libtpms libvirt libvirt-dbus libvirt-python nbdkit netcf perl-Sys-Virt qemu-kvm 6.1.1-6-el8 - CVE-2023-1544 is not applicable to Oracle QEMU 6.1.1 Karl Heubaum Orabug: 35305727 CVE-2023-1544 - virtio-gpu: do not byteswap padding Paolo Bonzini...

olcne security update

1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio config to include 1.15.7 to support upgrade from 1.5.x to 1.6.x 1.6.1-7 - Bugfix:Append a slash in oci-instance-metada query url 1.6.1-6 - Fixed helm installation in OLCNE upgrade 1.6.1-5 - Deprecate...

Actively exploited vulnerability fixed in Progress MOVEit

Progress has fixed a vulnerability in MOVEit Transfer. The vulnerability allows an unauthenticated remote malicious person able to obtain sensitive data processed through the application being processed. In addition, the vulnerability could potentially be exploited to obtain administrator...

Beware of Ghost Sites: Silent Threat Lurking in Your Salesforce Communities

Improperly deactivated and abandoned Salesforce Sites and Communities aka Experience Cloud could pose severe risks to organizations, leading to unauthorized access to sensitive data. Data security firm Varonis dubbed the abandoned, unprotected, and unmonitored resources "ghost sites." "When these...

Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 11

Package name: xms10.14.0.11121.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.11013.bin, xms10.14.0.10942.bin, xms10.14.0.10813.bin, xms10.14.0.10742.bin, xms10.14.0.10628.bin, xms10.14.0.10521.bin, xms10.14.0.10424.bin, xms10.14.0.10303.bin,...

Fedora 38 : python3.8 (2023-d8b0003ecd)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d8b0003ecd advisory. Fix for CVE-2023-24329 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

New macOS vulnerability, Migraine, could bypass System Integrity Protection

A new vulnerability, which we refer to as “Migraine” for its involvement with macOS migration, could allow an attacker with root access to automatically bypass System Integrity Protection SIP in macOS and perform arbitrary operations on a device. We shared these findings with Apple through...

A week in security (May 22-28)

Last week on Malwarebytes Labs: Update now: 9 vulnerabilities impact Cisco Small Business Series ChatGPT: Cybersecurity friend or foe? Webinar recap: EDR vs MDR for business success Identity crisis: How an anti-porn crusade could jam the Internet, featuring Alec Muffett: Lock and Code S04E11...

Fedora 37 : bottles / python-vkbasalt-cli (2023-328397d034)

The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-328397d034 advisory. Update bottles to 51.6 and release final dependency vkbasalt-cli Tenable has extracted the preceding description block directly from the Fedora...

Fedora 38 : python2.7 (2023-96aa33f0d3)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-96aa33f0d3 advisory. Fix for CVE-2023-24329 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

It’s apparently hip to still be using Windows 7

Welcome to this weeks edition of the Threat Source newsletter. As a longtime macOS user, I must admit Im behind the times when it comes to Microsoft Windows. Since buying a Steam Deck, Ive actually come to learn more about Linux and the Proton compatibility layer than I ever did about Windows. Bu...

WordPress Beautiful Cookie Consent Banner 2.10.1 Cross Site Scripting

Description: Beautiful Cookie Consent Banner = 2.10.1 - Unauthenticated Stored Cross-Site Scripting Affected Plugin:Beautiful Cookie Consent Banner Plugin Slug: beautiful-and-responsive-cookie-consent Affected Versions: = 2.10.1 CVE ID: Not Assigned CVSS Score: 7.2 High CVSS Vector:...

Fedora 37 : python-starlette (2023-b082504356)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-b082504356 advisory. Backport patch for GHSA-v5gw-mw7f-84px Path traversal vulnerability in StaticFiles. Tenable has extracted the preceding description block directly from the...

go-toolset:ol8 security update

delve 1.9.1-1.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.9.1-1 - Rebase to 1.9.1 - Related: rhbz2131026 golang 1.19.9-1 - Rebase to Go 1.19.9 - Resolves: rhbz2204473 go-toolset 1.19.9-1 - Rebase to Go 1.19.9 - Resolves: rhbz2204473...

RHEL 7 : rh-ruby27-ruby (RHSA-2023:3291)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3291 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system...

RHEL 7 : devtoolset-12-binutils (RHSA-2023:3269)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3269 advisory. The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includ...