Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,721 results · page 22 of 55
Dec 18, 2023 Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's defCVE-2023-41967 · Other software · Gallagher · reported by disclosures@gallagher.comLow 2.4
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's default diagnostic password and physical access to the Controller to view its configuration through the diagnostic web pages. This issue affects: Gallagher Controller 6000 8.70 prior to vCR8.70.231204a (distributed in 8.70.2375 (MR5)), v8.60 or earlier.
- Product
- Controller 6000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.comsecurity.gallagher.com
Dec 15, 2023Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access toCVE-2021-42797 · Other software · Aveva · reported by MITREHigh 7.5
Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commandsCVE-2021-42796 · Other software · Aveva · reported by MITRECritical 9.8
An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2023An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior.CVE-2021-42794 · Other software · Aveva · reported by MITREMedium 5.3
An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.
- Product
- Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2023Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2023-36878 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 8, 2023 Dell PowerEdge BIOS contains an improper privilege management security vulnerability.CVE-2023-32460 · Other software · Dell · reported by security_alert@emc.comHigh 8.8
Dell PowerEdge BIOS contains an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-38174 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 7, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-36880 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.8
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 7, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-35618 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Dec 5, 2023 Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability.CVE-2023-44298 · Other software · Dell · reported by security_alert@emc.comLow 3.6
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information tampering, code execution, denial of service.
- Product
- PowerEdge BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2023 Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability.CVE-2023-44297 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information disclosure, information tampering, code execution, denial of service.
- Product
- PowerEdge BIOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023KB Support – WordPress Help Desk and Knowledge Base: Missing AuthorizationCVE-2023-37890 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPOmnia KB Support – WordPress Help Desk and Knowledge Base allows Accessing Functionality Not Properly Constrained by ACLs. Users with a role as low as a subscriber can view other customers.This issue affects KB Support – WordPress Help Desk and Knowledge Base: from n/a through 1.5.88.
- Product
- KB Support – WordPress Help Desk and Knowledge Base
- Affected
- up to 1.5.88
- What to do
- Affects up to 1.5.88. Update KB Support – WordPress Help Desk and Knowledge Base to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 16, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36026 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 16, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36008 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 15, 2023Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hosCVE-2023-23549 · Other software · Checkmk GmbH · reported by security@checkmk.comLow 2.7
Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long hostnames.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmk.comcheckmk.com
Nov 14, 2023A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extractCVE-2023-39337 · Network & remote access · Ivanti · reported by support@hackerone.comCritical 9.1
A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious security risk, potentially exposing confidential data and system integrity.
- Product
- EPMM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.ivanti.comforums.ivanti.com
Nov 14, 2023Hyperledger Fabric is an open source permissioned distributed ledger framework.CVE-2023-46132 · Other software · hyperledger · reported by GitHubHigh 7.1
Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of the block. Additional validations have been add
- Product
- fabric
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36027 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 9, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36024 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 9, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36014 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 6, 2023Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityCVE-2023-36409 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 3, 2023Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload.CVE-2023-41357 · Other software · Galaxy Software Services · reported by twcert@cert.org.twHigh 8.8
Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operations or disrupt service.
- Product
- Vitals ESP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Nov 2, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36034 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 2, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36029 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.3
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Nov 2, 2023Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2023-36022 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.6
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 31, 2023An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connectionCVE-2023-42425 · Other software · turing · reported by MITRECritical 9.8
An issue in Turing Video Turing Edge+ EVC5FD v.1.38.6 allows remote attacker to execute arbitrary code and obtain sensitive information via the cloud connection components.
- Product
- edge\+_evc5fd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 30, 2023NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.CVE-2023-46129 · Other software · nats-io · reported by GitHubHigh 7.5
NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep.
- Product
- nkeys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Oct 30, 2023In Core, there is a possible way to forward calls without user knowledge due to a missing permission check.CVE-2023-21313 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 30, 2023Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability.CVE-2023-44323 · Email & office · Adobe · reported by AdobeMedium 5.5
Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Acrobat for Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.CVE-2023-5802 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Mihai Iova WordPress Knowledge base & Documentation Plugin – WP Knowledgebase plugin <= 1.3.4 versions.
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 25, 2023era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum.CVE-2023-46232 · Other software · matter-labs · reported by GitHubMedium 5.3
era-compiler-vyper is the EraVM Vyper compiler for zkSync Era, a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to era-compiler-vype version 1.3.10, a bug prevented the initialization of the first immutable variable for Vyper contracts meeting certain criteria. The problem arises when there is a String or Array with more 256-bit words allocated than initialized. It results in the second word’s index unset, that is effectively set to 0, so the first immutable value with the actual 0 index is overwritten in the ImmutableSimulator. Version 1.3.10 fixes this issue by setting all indexes in advance. The problem will go away, but it will get more expensive if the user allocates a lot of uninitialized space, e.g. `String[4096]`. Upgrading and redeploying affected contracts is the only way of working around the issue.
- Product
- era-compiler-vyper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerabiCVE-2023-46659 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
- Product
- Jenkins Edgewall Trac Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Oct 13, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36559 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.2
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Oct 10, 2023 An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during thCVE-2023-5450 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.3
An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2023 The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process.CVE-2023-43611 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.8
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. This vulnerability is due to an incomplete fix for CVE-2023-38418. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023 BIG-IP APM clients may send IP traffic outside of the VPN tunnel.CVE-2023-43125 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.8
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2023 BIG-IP APM clients may send IP traffic outside of the VPN tunnel.CVE-2023-43124 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 5.3
BIG-IP APM clients may send IP traffic outside of the VPN tunnel. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP Edge Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023 Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarCVE-2023-43637 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioHigh 7.8
Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo". This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always return "foobarfoobarfoobarfoobarfoobarfo" as the key), and then merges the 32byte randomly generated key with this key (by takeing 16bytes from each, see "mergeKeys"). This makes the key a lot weaker. This issue does not persist in devices that were initialized on/after version 7.10, but devices that were initialized before that and updated to a newer version still have this issue. Roll an update that enforces the full 32bytes key usage.
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023 When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used.CVE-2023-43634 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioHigh 8.8
When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a previous project, CYMOTIVE found that the configuration is not protected by the secure boot, and in response Zededa implemented measurements on the config partition that was mapped to PCR 13. In that process, PCR 13 was added to the list of PCRs that seal/unseal the key. In commit “56e589749c6ff58ded862d39535d43253b249acf”, the config partition measurement moved from PCR 13 to PCR 14, but PCR 14 was not added to the list of PCRs that seal/unseal the key. This change makes the measurement of PCR 14 effectively redundant as it would not affect the sealing/unsealing of the key. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023 On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”.CVE-2023-43633 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioHigh 8.8
On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”. If the file exists, it overrides the existing configuration on the device on boot. This allows an attacker to change the system’s configuration, which also includes some debug functions. This could be used to unlock the ssh with custom “authorized_keys” via the “debug.enable.ssh” key, similar to the “authorized_keys” finding that was noted before. Other usages include unlocking the usb to enable the keyboard via the “debug.enable.usb” key, allowing VNC access via the “app.allow.vnc” key, and more. An attacker could easily enable these debug functionalities without triggering the “measured boot” mechanism implemented by EVE OS, and without marking the device as “UUD” (“Unknown Update Detected”). This is because the “/config” partition is not protected by “measured boot”, it is mutable and it is not encrypted in any way. An attacker can gain full control over the device without changing the PCR values, thereby not triggering the “measured boot” mechanism, and having full access to the vault. Note: This issue was partially fixed in these commits (after disclosu
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023 As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clieCVE-2023-43632 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioCritical 9
As noted in the “VTPM.md” file in the eve documentation, “VTPM is a server listening on port 8877 in EVE, exposing limited functionality of the TPM to the clients. VTPM allows clients to execute tpm2-tools binaries from a list of hardcoded options” The communication with this server is done using protobuf, and the data is comprised of 2 parts: 1. Header 2. Data When a connection is made, the server is waiting for 4 bytes of data, which will be the header, and these 4 bytes would be parsed as uint32 size of the actual data to come. Then, in the function “handleRequest” this size is then used in order to allocate a payload on the stack for the incoming data. As this payload is allocated on the stack, this will allow overflowing the stack size allocated for the relevant process with freely controlled data. * An attacker can crash the system. * An attacker can gain control over the system, specifically on the “vtpm_server” process which has very high privileges.
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023 On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”.CVE-2023-43631 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioHigh 8.8
On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given keys as the authorized keys for root login. An attacker could easily add their own keys and gain full control over the system without triggering the “measured boot” mechanism implemented by EVE OS, and without marking the device as “UUD” (“Unknown Update Detected”). This is because the “/config” partition is not protected by “measured boot”, it is mutable, and it is not encrypted in any way. An attacker can gain full control over the device without changing the PCR values, thus not triggering the “measured boot” mechanism, and having full access to the vault. Note: This issue was partially fixed in these commits (after disclosure to Zededa), where the config partition measurement was added to PCR13: • aa3501d6c57206ced222c33aea15a9169d629141 • 5fef4d92e75838cc78010edaed5247dfbdae1889. This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer 1.0, allows remote aCVE-2023-40618 · Other software · Openknowledgemaps · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer 1.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'service' parameter in 'headstart_snapshot.php'.
- Product
- Head Start
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023 In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault.CVE-2023-43636 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioHigh 8.8
In EVE OS, the “measured boot” mechanism prevents a compromised device from accessing the encrypted data located in the vault. As per the “measured boot” design, the PCR values calculated at different stages of the boot process will change if any of their respective parts are changed. This includes, among other things, the configuration of the bios, grub, the kernel cmdline, initrd, and more. However, this mechanism does not validate the entire rootfs, so an attacker can edit the filesystem and gain control over the system. As the default filesystem used by EVE OS is squashfs, this is somewhat harder than an ext4, which is easily changeable. This will not stop an attacker, as an attacker can repackage the squashfs with their changes in it and replace the partition altogether. This can also be done directly on the device, as the “003-storage-init” container contains the “mksquashfs” and “unsquashfs” binaries (with the corresponding libs). An attacker can gain full control over the device without changing the PCR values, thus not triggering the “measured boot” mechanism, and having full access to the vault. Note: This issue was partially fixed in these commits (af
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023 Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism.CVE-2023-43635 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioHigh 8.8
Vault Key Sealed With SHA1 PCRs The measured boot solution implemented in EVE OS leans on a PCR locking mechanism. Different parts of the system update different PCR values in the TPM, resulting in a unique value for each PCR entry. These PCRs are then used in order to seal/unseal a key from the TPM which is used to encrypt/decrypt the “vault” directory. This “vault” directory is the most sensitive point in the system and as such, its content should be protected. This mechanism is noted in Zededa’s documentation as the “measured boot” mechanism, designed to protect said “vault”. The code that’s responsible for generating and fetching the key from the TPM assumes that SHA256 PCRs are used in order to seal/unseal the key, and as such their presence is being checked. The issue here is that the key is not sealed using SHA256 PCRs, but using SHA1 PCRs. This leads to several issues: • Machines that have their SHA256 PCRs enabled but SHA1 PCRs disabled, as well as not sealing their keys at all, meaning the “vault” is not protected from an attacker. • SHA1 is considered insecure and reduces the complexity level required to unseal the key in machines which have their SHA1 PCR
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2023PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fdCVE-2023-43630 · Other software · LF-Edge, Zededa · reported by cve@asrg.ioHigh 8.8
PCR14 is not in the list of PCRs that seal/unseal the “vault” key, but due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, fixing this issue alone would not solve the problem of the config partition not being measured correctly. Also, the “vault” key is sealed/unsealed with SHA1 PCRs instead of SHA256. This issue was somewhat mitigated due to all of the PCR extend functions updating both the values of SHA256 and SHA1 for a given PCR ID. However, due to the change that was implemented in commit “7638364bc0acf8b5c481b5ce5fea11ad44ad7fd4”, this is no longer the case for PCR14, as the code in “measurefs.go” explicitly updates only the SHA256 instance of PCR14, which means that even if PCR14 were to be added to the list of PCRs sealing/unsealing the “vault” key, changes to the config partition would still not be measured. An attacker could modify the config partition without triggering the measured boot, this could result in the attacker gaining full control over the device with full access to the contents of the encrypted “vault”
- Product
- EVE OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36735 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 15, 2023Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2023-36727 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.1
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 15, 2023Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityCVE-2023-36562 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.1
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Product
- Microsoft Edge (Chromium-based)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Sep 15, 2023 Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.CVE-2023-32461 · Other software · Dell · reported by security_alert@emc.comMedium 5
Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability, leading to corrupt memory and potentially escalate privileges.
- Product
- PowerEdge Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.