Wireshark Security Update (wnpa-sec-2023-28) - Linux

Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...

A week in security (November 25 – December 1)

Last week on Malwarebytes Labs: Printer problems? Beware the bogus help Data broker exposes 600,000 sensitive files including background checks Medical testing company LifeLabs failed to protect customer data, report finds Explained: the Microsoft connected experiences controversy Spotify, Audibl...

Apple TV < 18.1 Multiple Vulnerabilities (121569)

According to its banner, the version of Apple TV on the remote device is prior to 18.1. It is therefore affected by multiple vulnerabilities as described in the 121569 security advisory. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid211992; scriptversion"1.3";...

openSUSE Security Advisory (SUSE-SU-2024:4090-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:4086-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2024:4079-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIT-CILIUM-2024-52529 Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range AND 2. A Layer 7 allow policy that selects a specific port within the first policy's range...

Large Loss of Money? Choose Your LLM Security Solution Wisely.

...

Large Loss of Money? Choose Your LLM Security Solution Wisely.

...

Mozilla Firefox ESR Security Update (MFSA2024-64) - Windows

Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Mozilla Thunderbird Security Update (MFSA2024-67) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

CVE-2024-47257

CVE-2024-47257 affects Axis devices running AXIS OS, where handling certain Ethernet frames can cause the device to become unavailable on the network. The root cause is tied to how the vulnerable components process specific Ethernet frames, leading to network disruption. Axis has released patched...

CVE-2024-6831

Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove views without the necessary permission due to a client-side-only check. Axis has released patched versions for the highlighted flaw. Please refer to the Axis security advisory for...

GitLab 15.6 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-8177)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Inefficient Algorithmic Complexity in GitLab CVE-2024-8177 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.44 is vulnerable to Broken Authentication

Software Spam protection, AntiSpam, FireWall by CleanTalk Type Plugin Vulnerable versions = 6.44 Fixed in 6.45 OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-10781 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 0bd21f35fe5e...

WordPress WPGYM Plugin <= 67.1.0 is vulnerable to Broken Access Control

Software WPGYM Type Plugin Vulnerable versions = 67.1.0 Fixed in 67.2.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9941 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 71c6636a78f1 Credits Tonn Required privilege Subscriber...

Fedora 41 : needrestart (2024-a9cf3dad4f)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a9cf3dad4f advisory. Rebase to fix CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

WordPress 코드엠샵 소셜톡 Plugin <= 1.1.18 is vulnerable to Cross Site Scripting (XSS)

Software 코드엠샵 소셜톡 Type Plugin Vulnerable versions = 1.1.18 Fixed in 1.2.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11229 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 68c0c2cab457 Credits Peter Thaleikis Required...

Cohesive Networks VNS3 操作系统命令注入漏洞

Cohesive Networks VNS3 is a VPN Virtual Private Network solution from Cohesive Networks, Inc. Cohesive Networks VNS3 suffers from an operating system command injection vulnerability that stems from a lack of proper authentication before executing a system call using a user-supplied string. An...

WordPress WP User Manager Plugin <= 2.9.11 is vulnerable to Broken Access Control

Software WP User Manager Type Plugin Vulnerable versions = 2.9.11 Fixed in 2.9.12 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10216 Patch priority Low CVSS severity Low 4.3 Developer WP User Manager PSID dd84c78601e5 Credits BrokenAC ignore Required...