CVE-2024-36458

The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions...

CVE-2024-36458

CVE-2024-36458 affects Broadcom Symantec Privileged Access Management (PAM). The available documents confirm that a malicious, low-privileged PAM user can perform server upgrade related actions, indicating a privilege-escalation path within PAM components. The incident description is consistent a...

CVE-2024-36458 Symantec Privileged Access Manager Privilege Escalation vulnerability

The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions...

CVE-2024-36458 Symantec Privileged Access Manager Privilege Escalation vulnerability

The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions...

PT-2024-27012 · Broadcom · Symantec Privileged Access Management

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows a malicious low-privileged PAM user to perform server upgrade related actions. No information is provided about the estimated number of...

KB5032383: Servicing stack update for Windows Server 2008 R2 SP1: November 14, 2023

KB5032383: Servicing stack update for Windows Server 2008 R2 SP1: November 14, 2023 REMINDER As of January 10, 2023, Microsoft no longer provides security updates or technical support for Windows 7 Service Pack 1 SP1. We recommend that you upgrade to a supported version of Windows.Upgrade to...

UBUNTU-CVE-2023-46129

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server...

PT-2023-29861 · Unknown +1 · Nats Server +1

Name of the Vulnerable Software and Affected Versions: nkeys versions 0.4.0 through 0.4.5 NATS Server versions 2.10.0 through 2.10.3 Description: NATS.io is a high performance open source pub-sub distributed communication technology. The cryptographic key handling library, nkeys, recently gained...

October 10, 2023—KB5031416 (Monthly Rollup)

None None...

October 10, 2023—KB5031427 (Security-only update)

None None...

How to upgrade the SQL Server LocalDB (required for LHC) on the controllers

How to upgrade the local sql DB on the DDC's...

System addressbooks can be modified by malicious trusted server

None...

CVE-2023-32683 URL deny list bypass via oEmbed and image URLs when generating previews in Synapse

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. A discovered oEmbed or image URL can bypass the urlpreviewurlblacklist setting potentially allowing server side request forgery or bypassing network policies. Impact is limited to IP addresses allowed by the...

Improperly Controlled Sequential Memory Allocation

Overview Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation due to allowing remote attackers to send malicious requests that consume all memory available to the server. Remediation Upgrade OPCFoundation.NetStandard.Opc.Ua.Server to version...

CVE-2023-25817 Delete permissions are not saved when creating public share in Nextcloud server

Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their permissions to delete files they were not supposed to deletable but only viewed or downloaded. This issue has been addressed andit is recommended that the...

Missing length validation of user displayname allows to generate an SQL error

None...

CVE-2022-41877

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in drive channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version...

CVE-2022-39318 Division by zero in urbdrc channel in FreeRDP

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in urbdrc channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to...

CVE-2022-31014

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an...

CVE-2022-31014 SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an...