Security Bulletin: IBM Storage Protect Server is susceptible to numerous vulnerabilities due to Golang Go (CVE-2023-29409)

Summary Golang Go is used by the IBM Storage Protect Server OSSM component. Golang Go is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw. Vulnerability Details CVEID:CVE-2023-29409 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an...

Security Bulletin: Vulnerabilities in cryptography affect IBM Spectrum Sentinel Anomaly Scan Engine (239927)

Summary Vulnerabilities in python cryptography affect IBM Spectrum Sentinel Anomaly Scan Engine. Vulnerabilities include: Python cryptography allowing remote attacker to overflow a buffer and execute arbitrary code on the system. This bulletin identifies the steps to take to address the...

SUSE-SU-2023:4870-1 Security update for cosign

This update for cosign fixes the following issues: Updated to 2.2.1 jscSLE-23879 - Enhancements: CVE-2023-46737: Possible endless data attack from attacker-controlled registry bsc1216933 feat: Support basic auth and bearer auth login to registry 3310 add support for ignoring certificates with...

Service continuity is Not Supported with on-premises StoreFront or Gateway

This article describes the Supported scenarios for Service continuity Workspace connection leases feature...

SAP Solution Manager Command Injection Vulnerability

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as one of the system management platform. The platform can help customers establish SAP solution lifecycle management, and provide system...

CLSA-2023-1702496473 squid34: Fix of CVE-2023-46728

CVE-2023-46728: Remove support for Gopher protocol...

squid: Fix of CVE-2023-46728

CVE-2023-46728: Remove support for Gopher protocol - Enable test-suite...

(0Day) Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

[SECURITY] [DLA 3685-1] debian-security-support security update

Debian LTS Advisory DLA-3685-1 [email protected] https://www.debian.org/lts/security/ Holger Levsen December 13, 2023 https://wiki.debian.org/LTS Package : debian-security-support Version : 1:10+2023.13.12 Debian Bug : 982258, 1056606, 1053109. debian-security-support, the Debian securi...

CLSA-2023-1702420408 Fix CVE(s): CVE-2023-46728

SECURITY UPDATE: Denial of Service attack against Squid’s Gopher gateway due to a NULL pointer dereference bug - debian/patches/CVE-2023-46728.patch: remove support for Gopher protocol - CVE-2023-46728...

How to choose a free vulnerability scanner: Insights from an industry veteran

The cybersecurity market is awash with expensive, high-end solutions for detecting vulnerabilities in third-party applications. However, for smaller security teams, free vulnerability scanners offer a practical alternative. But of course, free doesn’t always mean better—it’s crucial to thoroughly...

CVE-2023-50247

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack quicly, as used by H2O up to commit 43f86e5 in version 2.3.0-beta and prior, is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivel...

Building an AppSec Program with Qualys WAS – Additional Configurations and Review & Confirm

Part 4 - Configuring a Web Application or API: Additional Configurations Now that we have completed the basic information, crawl settings, and default scan configurations, we can shift our attention to additional configurations designed to optimize scanning and provide granular control over how...

December 12, 2023—KB5033429 (Monthly Rollup)

None None...

December 12, 2023—KB5033424 (Security-only update)

None None...

December 12, 2023—KB5033420 (Monthly Rollup)

None None...

PT-2023-32743 · WordPress · Svg Support

Name of the Vulnerable Software and Affected Versions: SVG Support plugin for WordPress versions up to, and including, 2.5.5 Description: The issue is related to Stored Cross-Site Scripting via the SVG upload feature due to insufficient input sanitization and output escaping. This allows...

KB5033466: Servicing stack update for Windows Server 2008 SP2: December 12, 2023

KB5033466: Servicing stack update for Windows Server 2008 SP2: December 12, 2023 REMINDER Windows Server 2008 SP2 Extended Security Updates third and final year of ESU ended on January 10, 2023. Many customers are taking advantage of Azures commitment to security and compliance and have moved to...

New Microsoft Incident Response team guide shares best practices for security teams and leaders

As enterprise networks grow in both size and complexity, securing them from motivated cyberthreat actors becomes more challenging. The incident response process can be a maze that security professionals must quickly learn to navigate—which is no easy task. Surprisingly, many organizations still...

New Microsoft Incident Response team guide shares best practices for security teams and leaders

As enterprise networks grow in both size and complexity, securing them from motivated cyberthreat actors becomes more challenging. The incident response process can be a maze that security professionals must quickly learn to navigate—which is no easy task. Surprisingly, many organizations still...