OPENSUSE-SU-2023:0277-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium 117.0.5938.132 boo1215776: CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx boo1215778 CVE-2023-5186: Use after free in Passwords CVE-2023-5187: Use after free in Extensions - Chromium 117.0.5938.92: stability improvemen...

SUSE-SU-2023:3884-1 Security update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Security issues fixed: CVE-2023-20897: Do not fail on bad message pack message bsc1213441 CVE-2023-20898: Fixed Git Providers can read from the wrong environment because they get the same cache directory base name. bsc1214797, bsc1193948...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 1 (5.4.4-119)

This update provides important stability fixes for the core storage, object storage, and compute services. Vulnerability id: VSTOR-74982 Fixed the customization of S3 URLs with CNAME records. Vulnerability id: VSTOR-75137, VSTOR-75225 Fixed storage and metadata service issues related to incorrect...

CVE-2022-48606

Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may affect availability...

Security feature bypass

Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may affect availability...

Microsoft Error Reporting Local Privilege Elevation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Error Reporting Local Privilege Elevation Vulnerability', 'Description' = %q This module takes advantage of a bug in the way Windows...

CVE-2022-48606

CVE-2022-48606 affects Huawei HarmonyOS: a stability-related vulnerability in the binder background management and control module that may impact availability. Public sources relate HarmonyOS versions 3.0.0, 2.1.0, 2.0.1 and 2.0.0 as affected (per CNNVD). NVD lists a network-exposed, high-severit...

PT-2023-15878 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a stability-related vulnerability in the binder background management and control module. Successful exploitation of this...

SUSE-SU-2023:3737-1 Security update for bind

This update for bind fixes the following issues: Update to release 9.16.44: - CVE-2023-3341: Fixed stack exhaustion flaw in control channel code may cause named to terminate unexpectedly bsc1215472...

[Important] [Security] Virtuozzo ReadyKernel Patch 161.0 for Virtuozzo Hybrid Server 7.5

The cumulative Virtuozzo ReadyKernel patch was updated with security fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.5. Vulnerability id: PSBM-150027 3.10.0-1160.53.1.vz7.185.3 to 3.10.0-1160.90.1.vz7.200.7 A race condition in 'venetdev' leads to corrupted data in...

CVE-2023-32370

A vulnerability was found in webkit. A logic issue was addressed with improved validation. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 (5.4.4-112)

This update delivers a new feature for the compute service, performance optimization for the object storage, as well as stability, security, and performance improvements. Vulnerability id: VSTOR-74916 VMs with Windows Server 2019, Windows Server 2022, and Windows 10 fail to boot after installatio...

Virtuozzo Hybrid Server 7.5 Update 5 Hotfix 1 (7.5.5-266)

The Hotfix 1 for Virtuozzo Hybrid Server 7.5 Update 5 provides stability and usability bug fixes. Vulnerability id: PSBM-150085 After upgrading from Virtuozzo Hybrid Server 7.5 Update 4 to Virtuozzo Hybrid Server 7.5 Update 5, a new 'dkms-ice' module installation could cause a loss of network...

Windows Common Log File System Driver (clfs.sys) Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Common Log File System Driver clfs.sys Elevation of Privilege Vulnerability', 'Description' = %q A privilege escalation vulnerability...

LG Simple Editor Remote Code Execution Exploit

This Metasploit module exploits broken access control and directory traversal vulnerabilities in LG Simple Editor software for gaining code execution. The vulnerabilities exist in versions of LG Simple Editor prior to v3.21. By exploiting this flaw, an attacker can upload and execute a malicious...

Incorrect calculation of totalSupply(), balanceOf() in rUSDY.sol if the rate is unlinked from $1

Lines of code Vulnerability details Impact In rUSDY.sol, the functions totalSupply, balanceOf are calculated. totalSupply : function totalSupply public view returns uint256 return totalShares oracle.getPrice / 1e18 BPSDENOMINATOR; balanceOf : function balanceOfaddress account public view returns...

CVE-2023-4622

A use-after-free flaw was found in the Linux kernel's afunix component that allows local privilege escalation. The unixstreamsendpage function tries to add data to the last skb in the peer's recv queue without locking the queue. This issue leads to a race condition where the unixstreamsendpage...

SolarView Compact 6.00 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SolarView Compact unauthenticated remote command execution vulnerability.', 'Description' = %q CONTEC's SolarView™ Series enables you to monitor...

SolarView Compact 6.00 Remote Command Execution Exploit

This Metasploit module exploits a command injection vulnerability on the SolarView Compact version 6.00 web application via the vulnerable endpoint downloader.php. After exploitation, an attacker will have full access with the same user privileges under which the webserver is running typically as...

Apache NiFi H2 Connection String Remote Code Execution Exploit

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. This exploit will result in several shells 5-7. Successfully test...