CVE (2023-34298) Ivanti Secure Access Client Local Privilege Escalation

Summary A logged in Windows user can leverage functionality of the Pulse Secure / Ivanti Secure Access Client or Pulse Secure Installer Service to carry out a privilege escalation on the user machine. Mitigation None Currently Related Links https://forums.ivanti.com/s/article/New-Client-Side...

[slackware-security] Slackware 15.0 kernel

New kernel packages are available for Slackware 15.0 to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/linux-5.15.118/: Upgraded. These updates fix various bugs and security issues. Be sure to upgrade your initrd after upgrading the kernel packages. ...

SUSE-SU-2023:2594-1 Security update for SUSE Manager Server 4.2

This update fixes the following issues: release-notes-susemanager: - Update to 4.2.13 Salt has been upgraded to 3006.0 SUSE Linux Enterprise Server 15 SP5 Family support has been added openSUSE Leap 15.5 support has been added Automatic migration from Salt 3000 to Salt bundle Grafana upgraded to...

AWS CDK EKS overly permissive trust policies

If you are using the eks.Cluster or eks.FargateCluster construct we need you to take action. Other users are not affected and can stop reading. Impact The AWS Cloud Development Kit CDK allows for the definition of Amazon Elastic Container Service for Kubernetes EKS clusters. eks.Cluster and...

USN-6156-2 sssd regression

USN-6156-1 fixed a vulnerability in SSSD. In certain environments, not all packages ended up being upgraded at the same time, resulting in authentication failures when the PAM module was being used. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It w...

LockBit Ransomware Extorts $91 Million from U.S. Companies

The threat actors behind the LockBit ransomware-as-a-service RaaS scheme have extorted $91 million following hundreds of attacks against numerous U.S. organizations since 2020. That's according to a joint bulletin published by the U.S. Cybersecurity and Infrastructure Security Agency CISA, the...

CVE-2022-43684

CVE-2022-43684 describes an ACL bypass in ServiceNow Core functionality. Affected: ServiceNow Quebec (before Patch 10 Hot Fix 8b), Rome (before Patch 10 Hot Fix 1), San Diego (before Patch 7), Tokyo (before Tokyo Patch 1), and Utah (before Utah GA). Impact: authenticated users could access sensit...

PT-2023-24774 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.0.4 Discourse versions prior to 3.1.0.beta5 Description: An issue in Discourse allows an attacker to use the new topics dismissal endpoint to reveal the number of topics recently created in categories they don't...

PT-2023-16319 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.4 through 15.10.7 GitLab CE/EE versions 15.11 through 15.11.6 GitLab CE/EE versions 16.0 through 16.0.1 Description: An issue has been discovered in GitLab CE/EE where open redirection was possible via HTTP response...

UBUNTU-CVE-2023-2801

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS has a security vulnerability that originates from a version upgrade judgment vulnerability in the user profile module, which can be exploite...

CVE-2023-34088 Collabora Online has Stored Cross-Site-Scripting vulnerability in admin interface

Collabora Online is a collaborative online office suite. A stored cross-site scripting XSS vulnerability was found in Collabora Online prior to versions 22.05.13, 21.11.9.1, and 6.4.27. An attacker could create a document with an XSS payload as a document name. Later, if an administrator opened t...

CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

Security Bulletin: CVE-2022-41723 and CVE-2022-41721 may affect IBM CICS TX Advanced

Summary CVE CVE-2022-41723 and CVE-2022-41721 may affect IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable CVEs. Relevant Go related packages have been upgraded. Vulnerability Details CVEID:CVE-2022-41723 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by...

PT-2023-17687

Name of the Vulnerable Software and Affected Versions Spring Boot versions 2.5.0 through 2.5.14 Spring Boot versions 2.6.0 through 2.6.14 Spring Boot versions 2.7.0 through 2.7.11 Spring Boot versions 3.0.0 through 3.0.6 Spring Boot older unsupported versions Description There is potential for a...

Acceptance of Extraneous Untrusted Data With Trusted Data

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Acceptance of Extraneous Untrusted Data With Trusted Data through the processing of shortcodes in user-generated content. An attacker can manipulate...

PT-2023-2918 · Mitel · Mitel Mivoice Connect

Name of the Vulnerable Software and Affected Versions: Mitel MiVoice Connect versions through 19.3 SP2 Mitel MiVoice Connect versions 20.x Mitel MiVoice Connect versions 21.x Mitel MiVoice Connect versions 22.x through 22.24.1500.0 Description: The issue is related to insufficient validation for...

Security Bulletin: Open Source Dependency Vulnerability

Summary IBM Edge Application Manager 4.5 has resolved the vulnerability. Vulnerability Details CVEID:CVE-2021-43784 DESCRIPTION: Open Container Initiative runc could allow a remote authenticated attacker to bypass security restrictions, caused by an integer overflow in netlink bytemsg length fiel...

PT-2023-23172 · Unknown · Dhis2 Core

Name of the Vulnerable Software and Affected Versions: DHIS2 Core versions prior to 2.37.9.1 DHIS2 Core versions prior to 2.38.3.1 DHIS2 Core versions prior to 2.39.1.2 Description: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in th...

SUSE: Security Advisory (SUSE-SU-2023:2097-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...