Tenable Nessus < 10.6.2 Multiple Vulnerabilities (TNS-2023-37)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.6.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-37 advisory. - Nessus leverages third-party software to help provide underlying functionality...

[R1] Nessus Agent Version 10.4.3 Fixes Multiple Vulnerabilities

R1 Nessus Agent Version 10.4.3 Fixes Multiple Vulnerabilities Arnie Cabral Tue, 10/31/2023 - 14:09 Nessus Agent leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, zlib were found to contain vulnerabilities, and updated versions...

Security Bulletin: IBM Automation Decision Services October 2023 - Multiple CVEs addressed

Summary IBM Automation Decision Services is vulnerable to denial of service attacks in third party and open source used in the product for various functions. See full list below. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package ...

CVE-2023-45798

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

CVE-2023-45798

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

Input validation

In Yettiesoft VestCert versions 2.36 to 2.5.29, a vulnerability exists due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote code execution...

CVE-2023-45798

Affected product: Yettiesoft VestCert, versions 2.36–2.5.29. Root cause: improper validation of third-party modules allows loading arbitrary third-party modules, enabling remote code execution. Impact: remote code execution with high risk (CVE-2023-45798). The CVE notes indicate vulnerability is ...

PT-2023-29692 · Yettiesoft · Vestcert

Name of the Vulnerable Software and Affected Versions: Yettiesoft VestCert versions 2.36 to 2.5.29 Description: A vulnerability exists in Yettiesoft VestCert due to improper validation of third-party modules. This allows malicious actors to load arbitrary third-party modules, leading to remote co...

Yettiesoft VestCert Security Vulnerability

Yettiesoft VestCert is an application from Yettiesoft, Inc. A security vulnerability exists in Yettiesoft VestCert versions 2.36 through 2.5.29 that stems from improper validation of third-party modules, which allows malicious actors to load arbitrary third-party modules that can lead to remote...

Tenable Identity Exposure < 3.42.17 Multiple Vulnerabilities (TNS-2023-33)

According to its self-reported version, the Tenable Identity Exposure running on the remote host is prior to 3.42.17. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-33 advisory. Tenable Identity Exposure leverages third-party software to help provide underlyi...

Tenable Nessus Network Monitor < 6.3.0 Multiple Vulnerabilities (TNS-2023-34)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2023-46667

An issue was discovered in Fleet Server = v8.10.0 and v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in th...

CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File

An issue was discovered in Fleet Server = v8.10.0 and v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in th...

CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File

An issue was discovered in Fleet Server = v8.10.0 and v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in th...

CVE-2023-46667

Fleet Server vulnerability CVE-2023-46667 affects Fleet Server 8.10.0–8.10.2 where enrolment tokens are written in plaintext to log files, potentially enabling unauthorized agent enrolment and access to secrets (Elasticsearch and third‑party services) or arbitrary events. Exploitation is not desc...

Strategic Tips to Optimize Cybersecurity Consolidation

Say goodbye to security silos. Organizations are eager to take advantage of cybersecurity consolidation and make their security environments more manageable. Evolving incrementally and adopting a platform that supports third-party integrations are key to reducing cybersecurity complexity...

[R1] Nessus Network Monitor 6.3.0 Fixes Multiple Vulnerabilities

R1 Nessus Network Monitor 6.3.0 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 10/25/2023 - 15:33 Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, curl, chosen, datatables were found to contain...

Hardcoded credentials

The vulnerability allows an unprivileged untrusted third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcode...

CVE-2023-41372

The vulnerability allows an unprivileged untrusted third- party application to arbitrary modify the server settings of the Android Client application, inducing it to connect to an attacker - controlled malicious server.This is possible by forging a valid broadcast intent encrypted with a hardcode...

CVE-2023-41960

The vulnerability allows an unprivilegeduntrusted third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application itself...