CISA has also acknowledged the active exploitation of two vulnerabilities in the Apple WebKit browser engine. CISA has added the vulnerabilities to its Known Exploited Vulnerabilities Catalog and requested users to patch it before Dec 25, 2023. Clément Lecigne of Google’s Threat Analysis Group has discovered the CVE-2023-42916 and CVE-2023-42917. Apple, in its advisory, has mentioned … Continue reading “CISA Added Two WebKit Vulnerabilities to its Known Exploited Vulnerabilities Catalog (CVE-2023-42916 & CVE-2023-42917)”
Author: Diksha Ojha
OwnCloud Sensitive Information Disclosure Vulnerability (CVE-2023-49103)
OwnCloud, an open-source file sync and share solution, is vulnerable to an information disclosure vulnerability tracked as CVE-2023-49103. The vulnerability has a critical severity rating and the highest CVSS score of 10. On successful exploitation, an unauthorized attacker may expose sensitive information.
VMware Cloud Director Authentication Bypass Vulnerability (CVE-2023-34060)
Dustin Hartle from Ideal Integrations Inc. has discovered an authentication bypass vulnerability in VMware Cloud Director Appliance (VCD Appliance). CVE-2023-34060 is given critical severity with a CVSS score of 9.8. Successful exploitation of the vulnerability may allow an attacker to bypass login restrictions when authenticating.
CISA Warns of Service Location Protocol (SLP) Denial-of-Service Vulnerability (CVE-2023-29552)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an alert for a vulnerability in n the Service Location Protocol (SLP). Tracked as CVE-2023-29552, it has been given a high severity rating with a CVSS score of 7.8. Successful exploitation of the vulnerability will allow an attacker to launch a denial-of-service attack. CISA has … Continue reading “CISA Warns of Service Location Protocol (SLP) Denial-of-Service Vulnerability (CVE-2023-29552)”
QNAP QTS Command Injection Vulnerabilities (CVE-2023-23368 & CVE-2023-23369)
QNAP has released security advisories to address command injection vulnerabilities in multiple QNAP operating system versions. Tracked as CVE-2023-23368 and CVE-2023-23369, the vulnerabilities are rated as critical with a CVSS score of 9.8 and 9, respectively. Successful exploitation of the vulnerabilities may allow a remote attacker to execute commands via a network.
Cisco Firepower Management Center (FMC) Software Command Injection Vulnerability (CVE-2023-20048)
Cisco has released software updates to address a command injection vulnerability in the Firepower Management Center (FMC). Tracked as CVE-2023-20048, the vulnerability has been given a critical severity rating with a CVSS base score of 9.9. Successful exploitation of the vulnerability may allow an attacker to execute specific unauthorized configuration commands on a Firepower Threat … Continue reading “Cisco Firepower Management Center (FMC) Software Command Injection Vulnerability (CVE-2023-20048)”
Atlassian Confluence Data Center and Confluence Server Improper Authorization Vulnerability (CVE-2023-22518)
Atlassian has addressed a vulnerability in the Confluence Data Center and Confluence Server. CVE-2023-22518 has been given a critical severity vulnerability and a CVSS score of 9.1. Atlassian has not released much information regarding this improper authorization vulnerability. The advisory states that no proof of active exploitation is available for the vulnerability. The advisory states, … Continue reading “Atlassian Confluence Data Center and Confluence Server Improper Authorization Vulnerability (CVE-2023-22518)”
F5 BIG-IP Unauthenticated Remote Code Execution Vulnerability (CVE-2023-46747)
Thomas Hendrickson and Michael Weber of Praetorian Security, Inc. have discovered an authentication bypass vulnerability in F5 BIG-IP. Tracked as CVE-2023-46747, the vulnerability has a critical severity rating with a CVSS score of 9.8. Successful exploitation of the vulnerability may allow an attacker to perform remote code execution on the target system.
VMware Addresses Multiple Vulnerabilities in vCenter Server (CVE-2023-34048 & CVE-2023-34056)
VMware vCenter Server is vulnerable to out-of-bounds write (CVE-2023-34048) and partial information disclosure (CVE-2023-34056) vulnerabilities. Successful exploitation of the vulnerabilities may result in access to critical data and remote code execution. CISA has added the CVE-2023-34048 to its Known Exploited Vulnerabilities Catalog and requested users to patch it before February 12, 2024.
Oracle Patch Tuesday, October 2023 Security Update Review
Oracle has released its fourth quarterly edition of Critical Patch Update, which contains a group of patches for 387 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in Oracle code and third-party components included in Oracle products. During the Q4 2023 Oracle Critical Patch … Continue reading “Oracle Patch Tuesday, October 2023 Security Update Review”
