Re: cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by Georgi Guninski on Jan 14

Hi, thanks for the feedback :)

Which version of tar is vulnerable to this attack? I am pretty sure
this was fixed in tar and zip `long long` ago.

tar and zip on fedora 38 are definitely not vulnerable, they clear
the setuid bit.

I continue to suspect this is vulnerability because:
1. There is directory traversal protection for untrusted archives
2. tar and zip and not vulnerable

bash script for setuid files in tar:

#!/bin/bash

mkdir -p...

Re: cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by fulldisclosure on Jan 14

Am 08.01.24 um 10:25 schrieb Georgi Guninski:

It's not a vulnerability, as

a) cpio archives must archive that flag as cpio is part of RPM packages
and those
must be able to contain setuid flags. Otherwise, you would need to add
chmod u+s  cmds to any %POST
section. Breaking this, would invalidate so many existing packages =>
won't happen

note: initramfs makes use of cpio as well, but setuid is not needed
here, as it's...

Re: [SBA-ADV-20220120-01] MOKOSmart MKGW1 Gateway Improper Session Management

Posted by SBA - Advisory via Fulldisclosure on Jan 14

MITRE assigned CVE-2023-51059 for this issue.

cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by Georgi Guninski on Jan 08

cpio privilege escalation vulnerability via setuid files in cpio archive

Happy New Year, let in 2024 happiness be with you! :)

When extracting archives cpio (at least version 2.13) preserves
the setuid flag, which might lead to privilege escalation.

One example is r00t extracts to /tmp/ and scidiot runs /tmp/micq/backd00r
without further interaction from root.

We believe this is vulnerability, since directory traversal in cpio
is considered...

OXAS-ADV-2023-0006: OX App Suite Security Advisory

Posted by Martin Heiland via Fulldisclosure on Jan 08

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at https://documentation.open-xchange.com/security/advisories/.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Internal reference: MWB-2315
Type:...

OXAS-ADV-2023-0005: OX App Suite Security Advisory

Posted by Martin Heiland via Fulldisclosure on Jan 08

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at https://documentation.open-xchange.com/security/advisories/.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Internal reference: MWB-2261
Type:...

SSH-Snake: Automated SSH-Based Network Traversal

Posted by Joshua Rogers on Jan 08

SSH-Snake is a powerful tool designed to perform automatic network
traversal using SSH private keys discovered on systems, with the objective
of creating a comprehensive map of a network and its dependencies,
identifying to what extent a network can be compromised using SSH and SSH
private keys starting from a particular system.

SSH-Snake can automatically reveal the relationship between systems which
are connected via SSH, which would normally...

Windows PowerShell Single Quote Code Execution / Event Log Bypass

Posted by hyp3rlinx on Jan 04

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/WINDOWS_POWERSHELL_SINGLE_QUOTE_CODE_EXEC_EVENT_LOG_BYPASS.txt
[+] twitter.com/hyp3rlinx
[+] twitter.com/malvuln
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

[Product]
Microsoft Windows PowerShell

Built on the . NET Framework, Windows PowerShell helps IT professionals and
power users control and automate the...

RansomLord v2 - Anti-Ransomware Exploitation Tool / New Release

Posted by hyp3rlinx on Jan 04

RansomLord v2 - Anti-Ransomware Exploitation Tool

[Description]
RansomLord is a proof-of-concept Anti-Ransomware exploitation tool that
generates PE files, used to exploit vulnerable Ransomware pre-encryption.

Lang: C

SHA256 : 8EA83752C4096C778709C14B60B9735CC68A5971DCDB0028A0BB167550554769

This version now intercepts and terminates malware tested from 43 different
threat groups.
Adding Wagner, Hakbit, Paradise, Jaff, DoubleZero, Blacksnake,...

[ES2023-02] FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation

Posted by Sandro Gauci on Dec 26

# FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation

- Fixed versions: 1.10.11
- Enable Security Advisory:
https://github.com/EnableSecurity/advisories/tree/master/ES2023-02-freeswitch-dtls-hello-race
- Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-39gv-hq72-j6m6
- Other references: CVE-2023-51443
- Tested vulnerable versions: 1.10.10
- Timeline:
-...

asterisk release 20.5.1

Posted by Asterisk Development Team via Fulldisclosure on Dec 19

The Asterisk Development Team would like to announce security release
Asterisk 20.5.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.5.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

The following security advisories were resolved in this release:
- [Path traversal via AMI GetConfig allows access to outside
files](...

CORRECTED asterisk release 21.0.1

Posted by Asterisk Development Team on Dec 19

The earlier announcement should not have had any User or Upgrade notes.

The Asterisk Development Team would like to announce security release
Asterisk 21.0.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.0.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

The following security advisories were resolved in this release:
- [Path traversal via AMI GetConfig allows...

asterisk release 18.20.1

Posted by Asterisk Development Team via Fulldisclosure on Dec 19

The Asterisk Development Team would like to announce security release
Asterisk 18.20.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/18.20.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

The following security advisories were resolved in this release:
- [Path traversal via AMI GetConfig allows access to outside
files](...

CORRECTED asterisk release certified-18.9-cert6

Posted by Asterisk Development Team on Dec 19

The earlier release announcement should NOT have had any User or Upgrade
notes.

The Asterisk Development Team would like to announce security release
Certified Asterisk 18.9-cert6.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert6
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

The following security advisories were resolved in this release:...

[ES2023-03] RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation

Posted by Sandro Gauci on Dec 19

# RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation

- Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2
- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race
- Vendor Patch: https://github.com/sipwise/rtpengine/commit/e969a79428ac4a15cdf1c0a1c6f266dbdc7e60b6
- Tested vulnerable versions: mr11.5.1.6
- Timeline:...

[ES2023-01] Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation

Posted by Sandro Gauci on Dec 19

# Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation

- Fixed versions: 18.20.1, 20.5.1, 21.0.1,18.9-cert6
- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-01-asterisk-dtls-hello-race
- Vendor Security Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq
- Other references: CVE-2023-49786
- Tested vulnerable versions: 20.1.0
-...

[SBA-ADV-20220120-01] MOKOSmart MKGW1 Gateway Improper Session Management

Posted by SBA - Advisory via Fulldisclosure on Dec 19

# MOKOSmart MKGW1 Gateway Improper Session Management #

Link:
https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220120-01_MOKOSmart_MKGW1_Gateway_Improper_Session_Management

## Vulnerability Overview ##

MOKOSmart MKGW1 Gateway devices with firmware version 1.1.1 or below do
not provide an adequate session management for the administrative web
interface. This allows adjacent attackers with access to the management
network to...

APPLE-SA-12-19-2023-1 macOS Sonoma 14.2.1

Posted by Apple Product Security via Fulldisclosure on Dec 19

APPLE-SA-12-19-2023-1 macOS Sonoma 14.2.1

macOS Sonoma 14.2.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214048.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WindowServer
Available for: macOS Sonoma
Impact: A user who shares their screen may unintentionally share the...

[KIS-2023-14] PKP-WAL <= 3.4.0-3 (NativeImportExportPlugin) Remote Code Execution Vulnerability

Posted by Egidio Romano on Dec 19

---------------------------------------------------------------------------------
PKP-WAL <= 3.4.0-3 (NativeImportExportPlugin) Remote Code Execution
Vulnerability
---------------------------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-3
and prior versions, as used in Open...

Disclosure of CVE-2023-50917: RCE Vulnerability in MajorDoM

Posted by Balgogan via Fulldisclosure on Dec 19

**Introduction**

MajorDoMo, a beacon in Russian home automation and particularly favored by Raspberry Pi aficionados, has been a trusted
name for over a decade. With over 380 stars on its official GitHub repository at the time of writing
(https://github.com/sergejey/majordomo), its popularity is evident. However, lurking within its `thumb.php` module is a
severe unauthenticated Remote Code Execution (RCE) vulnerability before 0662e5e.
NOTE:...

SEC Consult SA-20231128 :: Missing Certificate Validation & User Enumeration in Anveo Mobile App and Server

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231128-0 >
=======================================================================
title: Missing Certificate Validation & User Enumeration
product: Anveo Mobile App and Server
vulnerable version: Mobile App: 10.0.0.359 / 2016-07-13; Server: 11.0.0.5
fixed version: -
CVE number: -
impact: Medium
homepage:...

SEC Consult SA-20231205 :: Argument injection leading to unauthenticated RCE and authentication bypass in Atos Unify OpenScape Session Border Controller (SBC), Branch, BCF

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231205-0 >
=======================================================================
title: Argument injection leading to unauthenticated RCE and
authentication bypass
product: Atos Unify OpenScape Session Border Controller (SBC)
Atos Unify OpenScape Branch
Atos Unify OpenScape BCF
vulnerable...

SEC Consult SA-20231211-0 :: Local Privilege Escalation via MSI installer in PDF24 Creator

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231211-0 >
=======================================================================
title: Local Privilege Escalation via MSI installer
product: PDF24 Creator (geek Software GmbH)
vulnerable version: <=11.15.1
fixed version: 11.15.2
CVE number: CVE-2023-49147
impact: High
homepage:...

SEC Consult SA-20231206 :: Kiosk Escape Privilege Escalation in One Identity Password Manager Secure Password Extension

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231206-0 >
=======================================================================
title: Kiosk Escape Privilege Escalation
product: One Identity Password Manager Secure Password Extension
vulnerable version: <5.13.1
fixed version: 5.13.1
CVE number: CVE-2023-48654
impact: critical
homepage:...

HNS-2023-04 - HN Security Advisory - Buffer overflow vulnerabilities with long path names in TinyDir

Posted by Marco Ivaldi on Dec 12

Hi,

Please find attached a security advisory that describes some buffer
overflow vulnerabilities we discovered in TinyDir.

* Title: Buffer overflow vulnerabilities with long path names in TinyDir
* Product: TinyDir <= 1.2.5
* Author: Marco Ivaldi <marco.ivaldi () hnsecurity it>
* Date: 2023-12-04
* CVE ID: CVE-2023-49287
* Severity: High - 7.7 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
* Vendor URL: https://github.com/cxong/tinydir...

APPLE-SA-12-11-2023-5 macOS Ventura 13.6.3

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-5 macOS Ventura 13.6.3

macOS Ventura 13.6.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214038.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accounts
Available for: macOS Ventura
Impact: An app may be able to access sensitive user data
Description: A...

APPLE-SA-12-11-2023-6 macOS Monterey 12.7.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-6 macOS Monterey 12.7.2

macOS Monterey 12.7.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214037.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accounts
Available for: macOS Monterey
Impact: An app may be able to access sensitive user data
Description: A...

APPLE-SA-12-11-2023-7 tvOS 17.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-7 tvOS 17.2

tvOS 17.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214040.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

AVEVideoEncoder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to disclose kernel memory...

APPLE-SA-11-30-2023-2 iOS 17.1.2 and iPadOS 17.1.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-11-30-2023-2 iOS 17.1.2 and iPadOS 17.1.2

iOS 17.1.2 and iPadOS 17.1.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214031.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WebKit
Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation
and later, iPad Pro...

APPLE-SA-12-11-2023-8 watchOS 10.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-8 watchOS 10.2

watchOS 10.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214041.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accounts
Available for: Apple Watch Series 4 and later
Impact: An app may be able to access sensitive user data
Description: A...

APPLE-SA-12-11-2023-1 Safari 17.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-1 Safari 17.2

Safari 17.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214039.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution...

APPLE-SA-11-30-2023-3 macOS Sonoma 14.1.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-11-30-2023-3 macOS Sonoma 14.1.2

macOS Sonoma 14.1.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214032.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Sonoma
Impact: Processing web content may disclose sensitive information. Apple
is...

APPLE-SA-12-11-2023-2 iOS 17.2 and iPadOS 17.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-2 iOS 17.2 and iPadOS 17.2

iOS 17.2 and iPadOS 17.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214035.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accounts
Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation
and later, iPad Pro...

APPLE-SA-12-11-2023-3 iOS 16.7.3 and iPadOS 16.7.3

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-3 iOS 16.7.3 and iPadOS 16.7.3

iOS 16.7.3 and iPadOS 16.7.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214034.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accounts
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd
generation and...

APPLE-SA-12-11-2023-4 macOS Sonoma 14.2

Posted by Apple Product Security via Fulldisclosure on Dec 12

APPLE-SA-12-11-2023-4 macOS Sonoma 14.2

macOS Sonoma 14.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214036.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accessibility
Available for: macOS Sonoma
Impact: Secure text fields may be displayed via the Accessibility
Keyboard...

SEC Consult SA-20231123 :: Uninstall Key Caching in Fortra Digital Guardian Agent Uninstaller

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Nov 27

SEC Consult Vulnerability Lab Security Advisory < 20231123-0 >
=======================================================================
title: Uninstall Key Caching
product: Fortra Digital Guardian Agent Uninstaller
(Data Loss Prevention)
vulnerable version: Agent: <7.9.4
fixed version: Agent: 7.9.4
CVE number: CVE-2023-6253
impact: High...

SEC Consult SA-20231122 :: Multiple Vulnerabilities in m-privacy TightGate-Pro

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Nov 27

SEC Consult Vulnerability Lab Security Advisory < 20231122-0 >
=======================================================================
title: Multiple Vulnerabilities
product: m-privacy TightGate-Pro
vulnerable version: Rolling Release, servers with the following package
versions are vulnerable:
tightgatevnc < 4.1.2~1
rsbac-policy-tgpro <...

Senec Inverters Home V1, V2, V3 Home & Hybrid Use of Hard-coded Credentials - CVE-2023-39169

Posted by Phos4Me via Fulldisclosure on Nov 27

Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

CVE-2023-46307

Posted by Kevin on Nov 27

running on the remote port specified during setup

[SYSS-2023-019] SmartNode SN200 - Unauthenticated OS Command Injection

Posted by Maurizio Ruchay via Fulldisclosure on Nov 27

Advisory ID: SYSS-2023-019
Product: SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway
Manufacturer: Patton LLC
Affected Version(s): <= 3.21.2-23021
Tested Version(s): 2.21.1-22041, 3.21.2-23021, 3.22.0-23083
Vulnerability Type: OS Command Injection (CWE-78)
Vulnerability Type: Improper Access Control (CWE-284)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2023-07-05
Public Disclosure: 2023-08-28
CVE...

CVE-2023-46307

Posted by Kevin on Nov 27

While conducting a penetration test for a client, they were running an
application called etc-browser which is a public GitHub project with a
Docker container. While fuzzing the web server spun up with etcd-browser
(which can run on any arbitrary port), the application had a Directory
Traversal vulnerability that is simply triggered with the following payload:

GET /../../../../../../../../../../../../etc/passwd

If running in the docker...

Survey on usage of security advisories

Posted by Aurich, Janik on Nov 27

Dear list members,

we are looking for voluntary participants for our survey, which was
developed in the context of a master thesis at the University of
Erlangen-Nuremberg.

The goal of the survey is to determine potential difficulties that may
occur when dealing with security advisories.
The focus of the study lies on the acquisition and maintenance of
security advisories
as well as the decision making based on their content.

Participants...

[CVE-2023-46383, CVE-2023-46384, CVE-2023-46385] Multiple vulnerabilities in Loytec products (2)

Posted by Chizuru Toyama on Nov 27

[+] CVE : CVE-2023-46383, CVE-2023-46384, CVE-2023-46385
[+] Title : Multiple vulnerabilities in Loytec LINX Configurator
[+] Vendor : LOYTEC electronics GmbH
[+] Affected Product(s) : LINX Configurator 7.4.10
[+] Affected Components : LINX Configurator
[+] Discovery Date : 01-Sep-2021
[+] Publication date : 03-Nov-2023
[+]...

[CVE-2023-46386, CVE-2023-46387, CVE-2023-46388, CVE-2023-46389] Multiple vulnerabilities in Loytec products (3)

Posted by Chizuru Toyama on Nov 27

[+] CVE : CVE-2023-46386, CVE-2023-46387, CVE-2023-46388, CVE-2023-46389
[+] Title : Multiple vulnerabilities in Loytec L-INX Automation Servers
[+] Vendor : LOYTEC electronics GmbH
[+] Affected Product(s) : LINX-151, Firmware 7.2.4, LINX-212, firmware 6.2.4
[+] Affected Components : L-INX Automation Servers
[+] Discovery Date :...

Senec Inverters Home V1, V2, V3 Home & Hybrid Cleartext Transmission of Authentication Credentials - CVE-2023-39172

Posted by Phos4Me via Fulldisclosure on Nov 12

Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Senec Inverters Home V1, V2, V3 Home & Hybrid Exposure of the Username to an Unauthorized Actor - CVE-2023-39168

Posted by Phos4Me via Fulldisclosure on Nov 12

Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Senec Inverters Home V1, V2, V3 Home & Hybrid Publicly Accessible Default Credentials- CVE-2023-39170

Posted by Phos4Me via Fulldisclosure on Nov 12

Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Senec Inverters Home V1, V2, V3 Home & Hybrid Publicly Accessible Management Interface “Local GUI”- CVE-2023-39171

Posted by Phos4Me via Fulldisclosure on Nov 12

Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

HNS-2023-03 - HN Security Advisory - Multiple vulnerabilities in Zephyr RTOS

Posted by Marco Ivaldi on Nov 12

Hi all,

Find attached a security advisory that details multiple
vulnerabilities we discovered in the Zephyr real-time operating
system.

* Title: Multiple vulnerabilities in Zephyr RTOS
* OS: Zephyr <= 3.4.0, except for:
* CVE-2023-4265 that affects Zephyr <= 3.3.0
* CVE-2023-4261 that affects Zephyr <= 3.5.0
* Author: Marco Ivaldi <marco.ivaldi () hnsecurity it>
* Date: 2023-11-07
* CVE IDs and severity:
* CVE-2023-3725 -...

[CVE-2023-46380, CVE-2023-46381, CVE-2023-46382] Multiple vulnerabilities in Loytec products

Posted by Chizuru Toyama on Nov 03

[+] CVE : CVE-2023-46380, CVE-2023-46381, CVE-2023-46382
[+] Title : Multiple vulnerabilities in Loytec LWEB-802, L-INX Automation Servers, L-IOB
I/O Controllers, L-VIS Touch Panels
[+] Vendor : LOYTEC electronics GmbH
[+] Affected Product(s) : LINX-212 firmware 6.2.4, LVIS-3ME12-A1 firmware 6.2.2, LIOB-586 firmware 6.2.3
[+] Affected Components :...

LKX-2023-001 VinChin VMWare Backup

Posted by Gregory Boddin via Fulldisclosure on Oct 27

VinChin Backup & Recovery is an all-in-one backup solution for virtual infrastructures supporting VMWare, KVM, Xen
Server, Hyper-V, OpenStack and more. The product also supports AWS, Azure and other cloud providers as backup storage.

VinChin has failed to acknowledge the various requests over a month period, we are thus disclosing the following
vulnerabilities:

CVE-2023-45499 - VinChin VMWare Backup 5.0 to 7.0
During our research we...

[KIS-2023-12] phpFox <= 4.8.13 (redirect) PHP Object Injection Vulnerability

Posted by Egidio Romano on Oct 27

--------------------------------------------------------------
phpFox <= 4.8.13 (redirect) PHP Object Injection Vulnerability
--------------------------------------------------------------

[-] Software Link:

https://www.phpfox.com

[-] Affected Versions:

Version 4.8.13 and prior versions.

[-] Vulnerability Description:

User input passed through the "url" request parameter to the
/core/redirect route is not properly sanitized...

[KIS-2023-11] SugarCRM <= 13.0.1 (set_note_attachment) Unrestricted File Upload Vulnerability

Posted by Egidio Romano on Oct 26

-------------------------------------------------------------------------------
SugarCRM <= 13.0.1 (set_note_attachment) Unrestricted File Upload
Vulnerability
-------------------------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 13.0.1 and prior versions.
Version 12.0.3 and prior versions.

[-] Vulnerability Description:

When handling the...

[KIS-2023-10] SugarCRM <= 13.0.1 (GetControl) Server-Side Template Injection Vulnerability

Posted by Egidio Romano on Oct 26

----------------------------------------------------------------------------
SugarCRM <= 13.0.1 (GetControl) Server-Side Template Injection
Vulnerability
----------------------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 13.0.1 and prior versions.
Version 12.0.3 and prior versions.

[-] Vulnerability Description:

There is a sort of Server-Side Template...

APPLE-SA-10-25-2023-1 iOS 17.1 and iPadOS 17.1

Posted by Apple Product Security via Fulldisclosure on Oct 25

APPLE-SA-10-25-2023-1 iOS 17.1 and iPadOS 17.1

iOS 17.1 and iPadOS 17.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213982.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Contacts
Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation
and later, iPad Pro...

APPLE-SA-10-25-2023-8 watchOS 10.1

Posted by Apple Product Security via Fulldisclosure on Oct 25

APPLE-SA-10-25-2023-8 watchOS 10.1

watchOS 10.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213988.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Find My
Available for: Apple Watch Series 4 and later
Impact: An app may be able to read sensitive location information...

APPLE-SA-10-25-2023-5 macOS Ventura 13.6.1

Posted by Apple Product Security via Fulldisclosure on Oct 25

APPLE-SA-10-25-2023-5 macOS Ventura 13.6.1

macOS Ventura 13.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213985.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

CoreAnimation
Available for: macOS Ventura
Impact: An app may be able to cause a denial-of-service
Description:...

APPLE-SA-10-25-2023-7 tvOS 17.1

Posted by Apple Product Security via Fulldisclosure on Oct 25

APPLE-SA-10-25-2023-7 tvOS 17.1

tvOS 17.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213987.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

mDNSResponder
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A device may be passively tracked by its Wi-Fi MAC...

APPLE-SA-10-25-2023-6 macOS Monterey 12.7.1

Posted by Apple Product Security via Fulldisclosure on Oct 25

APPLE-SA-10-25-2023-6 macOS Monterey 12.7.1

macOS Monterey 12.7.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213983.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

CoreAnimation
Available for: macOS Monterey
Impact: An app may be able to cause a denial-of-service...

APPLE-SA-10-25-2023-9 Safari 17.1

Posted by Apple Product Security via Fulldisclosure on Oct 25

APPLE-SA-10-25-2023-9 Safari 17.1

Safari 17.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213986.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Monterey and macOS Ventura
Impact: Processing web content may lead to arbitrary code execution...