Full Disclosure

CVE-2023-4911: Local Privilege Escalation in the glibc's ld.so

Posted by Qualys Security Advisory via Fulldisclosure on Oct 05

Qualys Security Advisory

Looney Tunables: Local Privilege Escalation in the glibc's ld.so
(CVE-2023-4911)

========================================================================
Contents
========================================================================

Summary
Analysis
Proof of concept
Exploitation
Acknowledgments
Timeline

========================================================================
Summary...

Full Disclosure

APPLE-SA-2023-10-04-1 iOS 17.0.3 and iPadOS 17.0.3

Posted by Apple Product Security via Fulldisclosure on Oct 05

APPLE-SA-2023-10-04-1 iOS 17.0.3 and iPadOS 17.0.3

iOS 17.0.3 and iPadOS 17.0.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213961.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Kernel
Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation
and later, iPad Pro...

Full Disclosure

SEC Consult SA-20231005 :: Open Redirect in SAP® BSP Test Application it00 (Bypass for CVE-2020-6215 Patch)

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Oct 05

SEC Consult Vulnerability Lab Security Advisory < 20231005-0 >
=======================================================================
title: Open Redirect in BSP Test Application it00
(Bypass for CVE-2020-6215 Patch)
product: SAP® Application Server ABAP and ABAP®
Platform (SAP_BASIS)
vulnerable version: see section "Vulnerable / tested versions"...

Full Disclosure

APPLE-SA-09-26-2023-2 macOS Sonoma 14

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-2 macOS Sonoma 14

macOS Sonoma 14 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213940.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Airport
Available for: Mac Studio (2022 and later), iMac (2019 and later), Mac
Pro (2019 and later), Mac mini (2018 and...

Full Disclosure

APPLE-SA-09-26-2023-1 Safari 17

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-1 Safari 17

Safari 17 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213941.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Safari
Available for: macOS Monterey and macOS Ventura
Impact: Visiting a website that frames malicious content may lead to UI...

Full Disclosure

APPLE-SA-09-26-2023-3 Additional information for APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-3 Additional information for APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7

iOS 16.7 and iPadOS 16.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213927.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

App Store
Available for: iPhone 8 and later, iPad Pro...

Full Disclosure

APPLE-SA-09-26-2023-5 Additional information for APPLE-SA-2023-09-21-7 macOS Monterey 12.7

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-5 Additional information for APPLE-SA-2023-09-21-7 macOS Monterey 12.7

macOS Monterey 12.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213932.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: macOS Monterey
Impact: An app...

Full Disclosure

APPLE-SA-09-26-2023-4 Additional information for APPLE-SA-2023-09-21-6 macOS Ventura 13.6

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-4 Additional information for APPLE-SA-2023-09-21-6 macOS Ventura 13.6

macOS Ventura 13.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213931.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: macOS Ventura
Impact: An app may...

Full Disclosure

APPLE-SA-09-26-2023-6 Xcode 15

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-6 Xcode 15

Xcode 15 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213939.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Dev Tools
Available for: macOS Ventura 13.5 and later
Impact: An app may be able to gain elevated privileges
Description: This issue was...

Full Disclosure

APPLE-SA-09-26-2023-7 iOS 17 and iPadOS 17

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-7 iOS 17 and iPadOS 17

iOS 17 and iPadOS 17 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213938.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Airport
Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation
and later, iPad Pro 10.5-inch,...

Full Disclosure

APPLE-SA-09-26-2023-8 watchOS 10

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-8 watchOS 10

watchOS 10 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213937.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

App Store
Available for: Apple Watch Series 4 and later
Impact: A remote attacker may be able to break out of Web Content
sandbox...

Full Disclosure

SEC Consult SA-20230927-0 :: Multiple Vulnerabilities in SAP® Enable Now Manager

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Oct 02

SEC Consult Vulnerability Lab Security Advisory < 20230927-0 >
=======================================================================
title: Multiple Vulnerabilities
product: SAP® Enable Now Manager
vulnerable version: 10.6.5 (Build 2804) Cloud Edition
fixed version: May 2023 Release
CVE number: N/A (cloud)
impact: high
homepage: https://www.sap.com/about.html...

Full Disclosure

APPLE-SA-09-26-2023-9 tvOS 17

Posted by Apple Product Security via Fulldisclosure on Oct 02

APPLE-SA-09-26-2023-9 tvOS 17

tvOS 17 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213936.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Airport
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to read sensitive location information...

Full Disclosure

SEC Consult SA-20230925-0 :: Stored Cross-Site Scripting in mb Support broker management solution openVIVA c2

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Oct 02

SEC Consult Vulnerability Lab Security Advisory < 20230925-0 >
=======================================================================
title: Stored Cross-Site Scripting
product: mb Support broker management solution openVIVA c2
vulnerable version: <20220801
fixed version: =>20220801
CVE number: CVE-2022-39172
impact: Medium
homepage: https://mbsupport.de...

Full Disclosure

[tool] WatchGuard Firebox Web Update Unpacker

Posted by retset on Sep 25

A small utility for extracting file system images from "sysa-dl" update
files.

https://github.com/ret5et/Watchguard_WebUI_Unpacker

Full Disclosure

APPLE-SA-2023-09-21-4 watchOS 10.0.1

Posted by Apple Product Security via Fulldisclosure on Sep 22

APPLE-SA-2023-09-21-4 watchOS 10.0.1

watchOS 10.0.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213928.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Kernel
Available for: Apple Watch Series 4 and later
Impact: A local attacker may be able to elevate their privileges. Apple...

Full Disclosure

APPLE-SA-2023-09-21-2 iOS 17.0.1 and iPadOS 17.0.1

Posted by Apple Product Security via Fulldisclosure on Sep 22

APPLE-SA-2023-09-21-2 iOS 17.0.1 and iPadOS 17.0.1

iOS 17.0.1 and iPadOS 17.0.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213926.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Kernel
Available for: iPhone XS and later, iPad Pro 12.9-inch 2nd generation
and later, iPad Pro...

Full Disclosure

APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7

Posted by Apple Product Security via Fulldisclosure on Sep 22

APPLE-SA-2023-09-21-3 iOS 16.7 and iPadOS 16.7

iOS 16.7 and iPadOS 16.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213927.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Additional CVE entries coming soon.

Kernel
Available for: iPhone 8 and later, iPad Pro (all models),...

Full Disclosure

APPLE-SA-2023-09-21-1 Safari 16.6.1

Posted by Apple Product Security via Fulldisclosure on Sep 22

APPLE-SA-2023-09-21-1 Safari 16.6.1

Safari 16.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213930.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WebKit
Available for: macOS Big Sur and Monterey
Impact: Processing web content may lead to arbitrary code
execution. Apple is...

Full Disclosure

APPLE-SA-2023-09-21-5 watchOS 9.6.3

Posted by Apple Product Security via Fulldisclosure on Sep 22

APPLE-SA-2023-09-21-5 watchOS 9.6.3

watchOS 9.6.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213929.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Kernel
Available for: Apple Watch Series 4 and later
Impact: A local attacker may be able to elevate their privileges. Apple...

Full Disclosure

APPLE-SA-2023-09-21-7 macOS Monterey 12.7

Posted by Apple Product Security via Fulldisclosure on Sep 22

APPLE-SA-2023-09-21-7 macOS Monterey 12.7

macOS Monterey 12.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213932.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Additional CVE entries coming soon.

Kernel
Available for: macOS Monterey
Impact: A local attacker may be able to...

Full Disclosure

APPLE-SA-2023-09-21-6 macOS Ventura 13.6

Posted by Apple Product Security via Fulldisclosure on Sep 22

APPLE-SA-2023-09-21-6 macOS Ventura 13.6

macOS Ventura 13.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213931.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Additional CVE entries coming soon.

Kernel
Available for: macOS Ventura
Impact: A local attacker may be able to...

Full Disclosure

Advisory X41-2023-001: Two Vulnerabilities in OPNsense

Posted by X41 D-Sec GmbH Advisories via Fulldisclosure on Sep 22

Advisory X41-2023-001: Two Vulnerabilities in OPNsense
===========================================================
Highest Severity Rating: High
Confirmed Affected Versions: 23.1.11_1, 23.7.3, 23.7.4
Confirmed Patched Versions: Commit 484753b2abe3fd0fcdb73d8bf00c3fc3709eb8b7
Vendor: Deciso B.V. / OPNsense
Vendor URL: https://opnsense.org
Credit: X41 D-Sec GmbH, Yasar Klawohn and JM
Status: Public
Advisory-URL:...

Full Disclosure

SEC Consult SA-20230829-0 :: Reflected Cross-Site Scripting (XSS) in PTC - Codebeamer (ALM Solution)

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 18

SEC Consult Vulnerability Lab Security Advisory < 20230829-0 >
=======================================================================
title: Reflected Cross-Site Scripting (XSS)
product: PTC - Codebeamer (ALM Solution)
vulnerable version: <=22.10-SP7, <=22.04-SP5, <=21.09-SP13
fixed version: >=22.10-SP8, >=22.04-SP6, >=21.09-SP14
CVE number: CVE-2023-4296...

Full Disclosure

SEC Consult SA-20230918-0 :: Authenticated Remote Code Execution and Missing Authentication in Atos Unify OpenScape

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 18

SEC Consult Vulnerability Lab Security Advisory < 20230918-0 >
=======================================================================
title: Authenticated Remote Code Execution and
Missing Authentication
product: Atos Unify OpenScape Session Border Controller
Atos Unify OpenScape Branch
Atos Unify OpenScape BCF
vulnerable version: OpenScape SBC...

Full Disclosure

[SYSS-2023-002] Razer Synapse - Local Privilege Escalation

Posted by Oliver Schwarz via Fulldisclosure on Sep 18

Advisory ID: SYSS-2023-002
Product: Razer Synapse
Manufacturer: Razer Inc.
Affected Version(s): Versions before 3.8.0428.042117 (20230601)
Tested Version(s): 3.8.0228.022313 (20230315)
under Windows 10 Pro (10.0.19044)
under Windows 11 Home (10.0.22621)
Vulnerability Type: Improper Privilege Management (CWE-269)...

Full Disclosure

APPLE-SA-2023-09-11-2 macOS Monterey 12.6.9

Posted by Apple Product Security via Fulldisclosure on Sep 18

APPLE-SA-2023-09-11-2 macOS Monterey 12.6.9

macOS Monterey 12.6.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213914.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

ImageIO
Available for: macOS Monterey
Impact: Processing a maliciously crafted image may lead to arbitrary...

Full Disclosure

APPLE-SA-2023-09-11-3 macOS Big Sur 11.7.10

Posted by Apple Product Security via Fulldisclosure on Sep 18

APPLE-SA-2023-09-11-3 macOS Big Sur 11.7.10

macOS Big Sur 11.7.10 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213915.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

ImageIO
Available for: macOS Big Sur
Impact: Processing a maliciously crafted image may lead to arbitrary
code...

Full Disclosure

APPLE-SA-2023-09-11-1 iOS 15.7.9 and iPadOS 15.7.9

Posted by Apple Product Security via Fulldisclosure on Sep 18

APPLE-SA-2023-09-11-1 iOS 15.7.9 and iPadOS 15.7.9

iOS 15.7.9 and iPadOS 15.7.9 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213913.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

ImageIO
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE
(1st...

Full Disclosure

APPLE-SA-2023-09-07-3 watchOS 9.6.2

Posted by Apple Product Security via Fulldisclosure on Sep 08

APPLE-SA-2023-09-07-3 watchOS 9.6.2

watchOS 9.6.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213907.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Wallet
Available for: Apple Watch Series 4 and later
Impact: A maliciously crafted attachment may result in arbitrary code...

Full Disclosure

APPLE-SA-2023-09-07-1 macOS Ventura 13.5.2

Posted by Apple Product Security via Fulldisclosure on Sep 08

APPLE-SA-2023-09-07-1 macOS Ventura 13.5.2

macOS Ventura 13.5.2 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213906.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

ImageIO
Available for: macOS Ventura
Impact: Processing a maliciously crafted image may lead to arbitrary
code...

Full Disclosure

APPLE-SA-2023-09-07-2 iOS 16.6.1 and iPadOS 16.6.1

Posted by Apple Product Security via Fulldisclosure on Sep 08

APPLE-SA-2023-09-07-2 iOS 16.6.1 and iPadOS 16.6.1

iOS 16.6.1 and iPadOS 16.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT213905.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

ImageIO
Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd
generation and...

Full Disclosure

Minor firefox DoS - semi silently polluting ~/Downloads with files

Posted by Georgi Guninski on Sep 05

This is barely a DoS, but since Chrome has explicit protection
against it, we decided to disclose it.

If firefox user visits a specially crafted page, then firefox
may create many files in `~/Downloads`,
The user is notified about this in a small dialog, but there is
no option to stop the downloads.
The potential denial of service is that the user must manually
delete the created files and this might be PITA.

Technically about the PoC: create...

Full Disclosure

AtlasVPN Linux Client 1.0.3 IP Leak Exploit

Posted by icudar via Fulldisclosure on Sep 04

The following is my 0day. This code, when executed on any website, disconnects the AtlasVPN linux client and leaks the
users IP address. I am not yet aware of it being used in the wild. However, it shows that AtlasVPN does not take their
users safety serious, because their software security decisions suck so massively that its hard to believe this is a
bug rather than a backdoor. Nobody can be this incompetent. I tried to contact their support...

Full Disclosure

Vulnerabilities in Internet Radio auna IR-160 SE (UIProto)

Posted by naphthalin via Fulldisclosure on Sep 04

The internet radio device auna IR-160 SE has multiple vulnerabilities.
It uses the firmware UIProto, different versions of which can also be
found in many other radios.

1. The firmware offers a rudimentary web API that can be reached on the
local network on port 80. This API is completely unauthenticated,
allowing anyone to control the radio over the local network. (already
known as CVE-2019-13474, but relevant for the other two findings)...

Full Disclosure

[CVE-2023-4491, CVE-2023-4492, CVE-2023-4493, CVE-2023-4494, CVE-2023-4495, CVE-2023-4496, CVE-2023-4497] Multiple vulnerabilities in EFS Software products

Posted by Rafael Pedrero on Aug 31

# Exploit Title: Easy Address Book Web Server v1.6 - Multiple
Vulnerabilities
# Discovery by: Rafael Pedrero
# Discovery Date: 2021-01-10
# CVE: CVE-2023-4491, CVE-2023-4492, CVE-2023-4493
# Vendor Homepage: http://www.efssoft.com/web-address-book-server.html
# Software Link : http://www.efssoft.com/eabws.exe (md5sum:
69f77623bb32589fb5343f598b61bbd9)
# Tested Version: 1.6
# Tested on: Windows 7, 10

# CVE-2023-4491: Vulnerability Type:...

Full Disclosure

Mozilla Firefox only stores up to 1024 HSTS entries

Posted by Konstantin on Aug 29

# VULNERABILITY
Mozilla Firefox only stores up to 1024 HSTS entries.
When the limit is reached, Firefox discards entries based on their age
and recent visits to the domain in question.

# IMPACT
The HSTS header ensures that once a page has been visited, the browser
will attempt to connect to it using HTTPS.
The limit means that Firefox effectively does not store any further HSTS
headers, as new ones permanently override each other.
Sites...

Full Disclosure

[KIS-2023-09] CrafterCMS <= 4.0.2 Multiple Reflected Cross-Site Scripting Vulnerabilities

Posted by Egidio Romano on Aug 23

---------------------------------------------------------------------------
CrafterCMS <= 4.0.2 Multiple Reflected Cross-Site Scripting
Vulnerabilities
---------------------------------------------------------------------------

[-] Software Link:

https://craftercms.org

[-] Affected Versions:

Version 4.0.2 and prior versions.
Version 3.1.27 and prior versions.

[-] Vulnerabilities Description:

There are multiple Reflected Cross-Site...

Full Disclosure

[KIS-2023-08] SugarCRM <= 12.2.0 Two SQL Injection Vulnerabilities

Posted by Egidio Romano on Aug 23

----------------------------------------------------
SugarCRM <= 12.2.0 Two SQL Injection Vulnerabilities
----------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 12.2.0 and prior versions.
Version 12.0.2 and prior versions.
Version 11.0.5 and prior versions.

[-] Vulnerabilities Description:

1) User input passed through the “metrics” parameter to the...

Full Disclosure

[KIS-2023-07] SugarCRM <= 12.2.0 (Docusign_GlobalSettings) PHP Object Injection Vulnerability

Posted by Egidio Romano on Aug 23

-------------------------------------------------------------------------------
SugarCRM <= 12.2.0 (Docusign_GlobalSettings) PHP Object Injection
Vulnerability
-------------------------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 12.2.0 and prior versions.
Version 12.0.2 and prior versions.
Version 11.0.5 and prior versions.

[-] Vulnerability...

Full Disclosure

[KIS-2023-06] SugarCRM <= 12.2.0 (updateGeocodeStatus) Bean Manipulation Vulnerability

Posted by Egidio Romano on Aug 23

------------------------------------------------------------------------
SugarCRM <= 12.2.0 (updateGeocodeStatus) Bean Manipulation Vulnerability
------------------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 12.2.0 and prior versions.
Version 12.0.2 and prior versions.
Version 11.0.5 and prior versions.

[-] Vulnerability Description:

The vulnerability...

Full Disclosure

[KIS-2023-05] SugarCRM <= 12.2.0 (Notes) Unrestricted File Upload Vulnerability

Posted by Egidio Romano on Aug 23

-----------------------------------------------------------------
SugarCRM <= 12.2.0 (Notes) Unrestricted File Upload Vulnerability
-----------------------------------------------------------------

[-] Software Link:

https://www.sugarcrm.com

[-] Affected Versions:

Version 12.2.0 and prior versions.
Version 12.0.2 and prior versions.
Version 11.0.5 and prior versions.

[-] Vulnerability Description:

When handling the "save"...

Full Disclosure

Re: Anomaly in Fedora `dnf update`: md5 mismatch of result

Posted by Jeffrey Walton on Aug 19

https://bugzilla.redhat.com/show_bug.cgi?id=1873876

Jeff

Full Disclosure

Re: Anomaly in Fedora `dnf update`: md5 mismatch of result

Posted by Michael Lazin on Aug 19

I would test it using sha256 instead of md5 before you jump to conclusions
but dnf doesn't use https by default and you need to jump through hoops to
get it working. I would say if you are a fedora user open a feature
request for https for dnf with the fedora team if you can repeat this with
sha256.

Peace,

Michael

Full Disclosure

Re: Anomaly in Fedora `dnf update`: md5 mismatch of result

Posted by Adrean Boyadzhiev on Aug 19

Probably a completely different root cause, but I have noticed similar
behavior with a Debian-based distribution during `# apt upgrade` and
when there are many packages for update and the internet connection is
not so good. I haven't investigated, but my assumptions were either Race
Conditions within verification logic or some logic related to the timestamp.

To my knowledge `md5` should be ok for calculating hash sums, many
prefer it...

Full Disclosure

Re: Anomaly in Fedora `dnf update`: md5 mismatch of result

Posted by Matthew Fernandez on Aug 19

If the VM had no access to the internet even a retry would fail, no?

If an attempted update based on a delta-rpm fails, dnf falls back to
downloading a full rpm and using this instead.

Full Disclosure

KL-001-2023-003: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Modification via sudoedit

Posted by KoreLogic Disclosures via Fulldisclosure on Aug 17

KL-001-2023-003: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Modification via sudoedit

Title: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Modification via sudoedit
Advisory ID: KL-001-2023-003
Publication Date: 2023.08.17
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2023-003.txt

1. Vulnerability Details

     Affected Vendor: ThousandEyes
     Affected Product:...

Full Disclosure

KL-001-2023-002: Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege Escalation via tcpdump

Posted by KoreLogic Disclosures via Fulldisclosure on Aug 17

KL-001-2023-002: Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege Escalation via tcpdump

Title: Cisco ThousandEyes Enterprise Agent Virtual Appliance Privilege Escalation via tcpdump
Advisory ID: KL-001-2023-002
Publication Date: 2023.08.17
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2023-002.txt

1. Vulnerability Details

     Affected Vendor: ThousandEyes
     Affected Product: ThousandEyes...

Full Disclosure

KL-001-2023-001: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Read via sudo dig

Posted by KoreLogic Disclosures via Fulldisclosure on Aug 17

KL-001-2023-001: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Read via sudo dig

Title: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Read via sudo dig
Advisory ID: KL-001-2023-001
Publication Date: 2023.08.17
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2023-001.txt

1. Vulnerability Details

     Affected Vendor: ThousandEyes
     Affected Product: ThousandEyes...

Full Disclosure

Anomaly in Fedora `dnf update`: md5 mismatch of result

Posted by Georgi Guninski on Aug 15

In short, I found anomaly in Fedora 37 and would like to
know if it is vulnerability.

As root type in terminal:
dnf update

If there is kernel update, watch stdout and stderr for:

##On Mon Aug 14 05:33:29 AM UTC 2023
(2/6): kernel-6.4.10-100.fc37.x86_64.rpm 1.2 MB/s | 140 kB 00:00
/var/cache/dnf/updates-fd4d3d0d1c34d49a/packages/kernel-modules-extra-6.4.9-100.fc37_6.4.10-100.fc37.x86_64.drpm:
md5 mismatch of result

##$ md5sum...

Full Disclosure

Missing Immutable Root of Trust in Hardware (CWE-1326) / CVE-2023-22955

Posted by Moritz Abrell via Fulldisclosure on Aug 15

Advisory ID: SYSS-2022-055
Product: AudioCodes VoIP Phones
Manufacturer: AudioCodes Ltd.
Affected Version(s): Firmware Versions >= 3.4.4.1000
Tested Version(s): Firmware Version 3.4.4.1000
Vulnerability Type: Missing Immutable Root of Trust in Hardware (CWE-1326)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2022-11-14
Solution...

Full Disclosure

Use of Hard-coded Cryptographic Key (CWE-321) / CVE-2023-22957

Posted by Moritz Abrell via Fulldisclosure on Aug 15

Advisory ID: SYSS-2022-052
Product: AudioCodes VoIP Phones
Manufacturer: AudioCodes Ltd.
Affected Version(s): Firmware Versions >= 3.4.8.M4
Tested Version(s): Firmware Version 3.4.4.1000
Vulnerability Type: Use of Hard-coded Cryptographic Key (CWE-321)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2022-11-11
Solution Date:...

Full Disclosure

Use of Hard-coded Cryptographic Key (CWE-321) / CVE-2023-22956

Posted by Moritz Abrell via Fulldisclosure on Aug 15

Advisory ID: SYSS-2022-054
Product: AudioCodes VoIP Phones
Manufacturer: AudioCodes Ltd.
Affected Version(s): Firmware Versions >= 3.4.8.M4
Tested Version(s): Firmware Version 3.4.4.1000
Vulnerability Type: Use of Hard-coded Cryptographic Key (CWE-321)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2022-11-11
Solution Date:...

Full Disclosure

Qualys mis-uses ssh, fails to scan and protect, facilitates internal attack

Posted by Paul Szabo via Fulldisclosure on Aug 11

=== Introduction ===================================================

My institution uses Qualys

www.qualys.com

to scan for vulnerabilities, including on some Debian Linux machines
that I manage. The scanner does some network scans, and also logs in
to each machine to do "authenticated scans".

=== Discovery ======================================================

When I recently updated my machines from Debian11 to Debian12, the...

Full Disclosure

St. Poelten UAS | Multiple Vulnerabilities in Phoenix Contact TC Cloud Client / TC Router / Cloud Client

Posted by Weber Thomas via Fulldisclosure on Aug 11

St. Pölten UAS
-------------------------------------------------------------------------------
title| Multiple Vulnerabilities
product| Phoenix Contact TC Cloud Client 1002-4G*,
| TC Router 3002T-4G, Cloud Client 1101T-TX/TX
vulnerable version| <2.07.2, <2.07.2, <2.06.10
fixed version| 2.07.2, 2.07.2, 2.06.10
CVE number| CVE-2023-3526, CVE-2023-3569
impact|...

Full Disclosure

St. Poelten UAS | Multiple XSS in Advantech EKI 15XX Series

Posted by Weber Thomas via Fulldisclosure on Aug 11

St. Pölten UAS
-------------------------------------------------------------------------------
title| Multiple XSS in Advantech
product| Advantech EKI-1524-CE series, EKI-1522 series,
| EKI-1521 series
vulnerable version| <=1.21 (CVE-2023-4202), <=1.24 (CVE-2023-4203)
fixed version| 1.26
CVE number| CVE-2023-4202, CVE-2023-4203
impact| Medium...

Full Disclosure

GNOME Files silently extracts setuid files from ZIP archives

Posted by Georgi Guninski on Aug 07

Affected: GNOME Files 43.4 (nautilus) on fedora 37

Description:

If an user A opens in GNOME files zip archive containing
`setuid` file F, then F will be silently extracted to
a subdirectory of CWD.

If F is accessible by hostile local user B and B executes F,
then F will be executed as from user A.

tar(1) and unzip(1) are not vulnerable to this attack.

Session for creating the ZIP.
After that just open f.zip in GNOME files.
<pre>...

Full Disclosure

Kolibri GET request buffer Overflow [Stack Egghunter]

Posted by Mahmoud Noureldin on Aug 03

#!/usr/bin/python3
# Exploit Title: Kolibri GET request buffer Overflow [Stack Egghunter]
# Date: 2 Augst 2023
# Exploit Author: Mahmoud NourEldin @Engacker
# Vendor App:
https://www.exploit-db.com/apps/4d4e15b98e105facf94e4fd6a1f9eb78-Kolibri-2.0-win.zip
# Version: Kolibri 2.0
# Tested on: Windows 10
# Description:
# For the first time making the egghunter jumping to the begging of the
stack

import socket, time, sys, os

if len(sys.argv) != 3:...

Full Disclosure

[SYSS-2023-011]: Canon PIXMA TR4550 and other inkjet printer models - Insufficient or Incomplete Data Removal, within Hardware Component (CWE-1301)

Posted by Matthias Deeg via Fulldisclosure on Aug 03

Advisory ID: SYSS-2023-011
Product: PIXMA TR4550
Manufacturer: Canon
Affected Version(s): 1.020 / 1.080
also affects many other Canon inkjet printer
models[4]
Tested Version(s): 1.020 / 1.080
Vulnerability Type: Insufficient or Incomplete Data Removal
within Hardware Component (CWE-1301)...

Full Disclosure

OXAS-ADV-2023-0003: OX App Suite Security Advisory

Posted by Martin Heiland via Fulldisclosure on Aug 02

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at https://documentation.open-xchange.com/security/advisories/.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Internal reference: OXUIB-2282
Type:...