‼ CVE-2023-3576 ‼
📖 Read
via "National Vulnerability Database".
A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39191 ‼
📖 Read
via "National Vulnerability Database".
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42448 ‼
📖 Read
via "National Vulnerability Database".
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5402 ‼
📖 Read
via "National Vulnerability Database".
A?CWE-269: Improper Privilege Management vulnerability exists?that could cause?a local privilege escalation?when the transfer command is used.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38701 ‼
📖 Read
via "National Vulnerability Database".
Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `commit` validator, where they remain until they are either collected into the `head` validator or the protocol initialisation is aborted and the value in the committed UTxOs is returned to the users who committed them. Prior to version 0.12.0, the `commit` validator contains a flawed check when the `ViaAbort` redeemer is used, which allows any user to spend any UTxO which is at the validator arbitrarily, meaning an attacker can steal the funds that users are trying to commit into the head validator. The intended behavior is that the funds must be returned to the user which committed the funds and can only be performed by a participant of the head. The `initial` validator also is similarly affected as the same flawed check is performed for the `ViaAbort` redeemer. Due to this issue, an attacker can steal any funds that user's try to commit into a Hydra head. Also, an attacker can prevent any Hydra head from being successfully opened. It does not allow an attacker to take funds which have been successfully collected into and currently reside in the `head` validator. Version 0.12.0 contains a fix for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27121 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cronString parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42824 ‼
📖 Read
via "National Vulnerability Database".
The issue was addressed with improved checks. This issue is fixed in iOS 17.0.3 and iPadOS 17.0.3. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5399 ‼
📖 Read
via "National Vulnerability Database".
A?CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')?vulnerability exists?that could cause?a path traversal issue?when?using the File Command. 📖 Read
via "National Vulnerability Database".
🕴 37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety
WASHINGTON – October 3, 2023 – The National Cybersecurity Alliance (NCA), the nation’s leading nonprofit empowering a more secure and interconnected world, and CybSafe, the leading behavioral risk platform, today announced the release of Oh Behave! The Annual…
🕴 Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap
SAN FRANCISCO — October 4, 2023 –– Okta, Inc. (NASDAQ:OKTA), the leading independent identity partner, today announced the launch of a new initiative focused on finding and developing the best cybersecurity talent and providing equitable access to thriving…
🕴 ForAllSecure Announces First Dynamic Software Bill of Materials for Application Security 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
ForAllSecure Announces Dynamic Software Bill of Materials for Application Security
PRESS RELEASE
❤1
‼ CVE-2023-36619 ‼
📖 Read
via "National Vulnerability Database".
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43793 ‼
📖 Read
via "National Vulnerability Database".
Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42808 ‼
📖 Read
via "National Vulnerability Database".
Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that user-controlled data flows to a path expression (path of a network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin. As of time of publication, it is unknown whether any patches or workarounds exist.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41094 ‼
📖 Read
via "National Vulnerability Database".
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing durationThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38538 ‼
📖 Read
via "National Vulnerability Database".
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43799 ‼
📖 Read
via "National Vulnerability Database".
Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the software running on MacOS, Windows, and Linux. Version 5.2.5 fixes this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36618 ‼
📖 Read
via "National Vulnerability Database".
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users.📖 Read
via "National Vulnerability Database".