‼ CVE-2023-23946 ‼
📖 Read
via "National Vulnerability Database".
Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23378 ‼
📖 Read
via "National Vulnerability Database".
Print 3D Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21806 ‼
📖 Read
via "National Vulnerability Database".
Power BI Report Server Spoofing Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21820 ‼
📖 Read
via "National Vulnerability Database".
Windows Distributed File System (DFS) Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23379 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Defender for IoT Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23934 ‼
📖 Read
via "National Vulnerability Database".
Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain. Werkzeug prior to 2.2.3 will parse the cookie `=__Host-test=bad` as __Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key. The issue is fixed in Werkzeug 2.2.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21822 ‼
📖 Read
via "National Vulnerability Database".
Windows Graphics Component Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-25577 ‼
📖 Read
via "National Vulnerability Database".
Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug's multipart form data parser will parse an unlimited number of parts, including file parts. Parts can be a small amount of bytes, but each requires CPU time to parse and may use more memory as Python data. If a request can be made to an endpoint that accesses `request.data`, `request.form`, `request.files`, or `request.get_data(parse_form_data=False)`, it can cause unexpectedly high resource usage. This allows an attacker to cause a denial of service by sending crafted multipart data to an endpoint that will parse it. The amount of CPU time required can block worker processes from handling legitimate requests. The amount of RAM required can trigger an out of memory kill of the process. Unlimited file parts can use up memory and file handles. If many concurrent requests are sent continuously, this can exhaust or kill all available workers. Version 2.2.3 contains a patch for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21818 ‼
📖 Read
via "National Vulnerability Database".
Windows Secure Channel Denial of Service Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21777 ‼
📖 Read
via "National Vulnerability Database".
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21805 ‼
📖 Read
via "National Vulnerability Database".
Windows MSHTML Platform Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23377 ‼
📖 Read
via "National Vulnerability Database".
3D Builder Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21797 ‼
📖 Read
via "National Vulnerability Database".
Microsoft ODBC Driver Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21794 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Edge (Chromium-based) Spoofing Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21812 ‼
📖 Read
via "National Vulnerability Database".
Windows Common Log File System Driver Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
♟️ Microsoft Patch Tuesday, February 2023 Edition ♟️
📖 Read
via "Krebs on Security".
Microsoft is sending the world a whole bunch of love today, in the form of patches to plug dozens of security holes in its Windows operating systems and other software. This year's special Valentine's Day Patch Tuesday includes fixes for a whopping three different "zero-day" vulnerabilities that are already being used in active attacks.📖 Read
via "Krebs on Security".
Krebs on Security
Microsoft Patch Tuesday, February 2023 Edition
Microsoft is sending the world a whole bunch of love today, in the form of patches to plug dozens of security holes in its Windows operating systems and other software. This year's special Valentine's Day Patch Tuesday includes fixes for…
⚠ Microsoft Patch Tuesday: 36 RCE bugs, 3 zero-days, 75 CVEs ⚠
📖 Read
via "Naked Security".
Lots of lovely patches for your Valentine's Day delight. Get 'em as soon as you can...📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🕴 9 New Microsoft Bugs to Patch Now 🕴
📖 Read
via "Dark Reading".
78 new CVEs patched in this month's batch — nearly half of which are remotely executable and three of which attackers already are exploiting.📖 Read
via "Dark Reading".
Dark Reading
9 New Microsoft Bugs to Patch Now
78 new CVEs patched in this month's batch — nearly half of which are remotely executable and three of which attackers already are exploiting.
🕴 OT Network Security Myths Busted in a Pair of Hacks 🕴
📖 Read
via "Dark Reading".
How newly exposed security weaknesses in industrial wireless, cloud-based interfaces, and nested PLCs serve as a wake-up call for hardening the physical process control layer of the OT network.📖 Read
via "Dark Reading".
Dark Reading
OT Network Security Myths Busted in a Pair of Hacks
How newly exposed security weaknesses in industrial wireless, cloud-based interfaces, and nested PLCs serve as a wake-up call for hardening the physical process control layer of the OT network.
‼ CVE-2023-23618 ‼
📖 Read
via "National Vulnerability Database".
Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially runs executables from the current directory inadvertently, which can be exploited with some social engineering to trick users into running untrusted code. A patch is available in version 2.39.2. As a workaround, avoid using `gitk` (or Git GUI's "Visualize History" functionality) in clones of untrusted repositories.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-21815 ‼
📖 Read
via "National Vulnerability Database".
Visual Studio Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".