APPLE-SA-01-22-2024-6 macOS Ventura 13.6.4

Posted by Apple Product Security via Fulldisclosure on Jan 26

APPLE-SA-01-22-2024-6 macOS Ventura 13.6.4

macOS Ventura 13.6.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214058.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: macOS Ventura
Impact: An app may be able to execute arbitrary code with...

🏷️ My labels
- ❌
January 26^th 2024 at 15:07

APPLE-SA-01-22-2024-5 macOS Sonoma 14.3

Posted by Apple Product Security via Fulldisclosure on Jan 26

APPLE-SA-01-22-2024-5 macOS Sonoma 14.3

macOS Sonoma 14.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214061.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for: macOS Sonoma
Impact: An app may be able to execute arbitrary code with kernel...

🏷️ My labels
- ❌
January 26^th 2024 at 15:07

Full Disclosure
APPLE-SA-01-22-2024-4 iOS 15.8.1 and iPadOS 15.8.1
January 26^th 2024 at 15:07

APPLE-SA-01-22-2024-4 iOS 15.8.1 and iPadOS 15.8.1

Posted by Apple Product Security via Fulldisclosure on Jan 26

APPLE-SA-01-22-2024-4 iOS 15.8.1 and iPadOS 15.8.1

iOS 15.8.1 and iPadOS 15.8.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214062.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WebKit
Available for: iPhone 6s (all models), iPhone 7 (all models), iPhone SE
(1st generation),...

🏷️ My labels
- ❌
January 26^th 2024 at 15:07

Full Disclosure
APPLE-SA-01-22-2024-3 iOS 16.7.5 and iPadOS 16.7.5
January 26^th 2024 at 15:07

APPLE-SA-01-22-2024-3 iOS 16.7.5 and iPadOS 16.7.5

Posted by Apple Product Security via Fulldisclosure on Jan 26

APPLE-SA-01-22-2024-3 iOS 16.7.5 and iPadOS 16.7.5

iOS 16.7.5 and iPadOS 16.7.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214063.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Accessibility
Available for: iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation,
iPad Pro...

🏷️ My labels
- ❌
January 26^th 2024 at 15:07

Full Disclosure
APPLE-SA-01-22-2024-2 iOS 17.3 and iPadOS 17.3
January 26^th 2024 at 15:07

APPLE-SA-01-22-2024-2 iOS 17.3 and iPadOS 17.3

Posted by Apple Product Security via Fulldisclosure on Jan 26

APPLE-SA-01-22-2024-2 iOS 17.3 and iPadOS 17.3

iOS 17.3 and iPadOS 17.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214059.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Apple Neural Engine
Available for devices with Apple Neural Engine: iPhone XS and later,
iPad Pro...

🏷️ My labels
- ❌
January 26^th 2024 at 15:07

APPLE-SA-01-22-2024-1 Safari 17.3

Posted by Apple Product Security via Fulldisclosure on Jan 26

APPLE-SA-01-22-2024-1 Safari 17.3

Safari 17.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214056.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

Safari
Available for: macOS Monterey and macOS Ventura
Impact: A user's private browsing activity may be visible in Settings...

🏷️ My labels
- ❌
January 26^th 2024 at 15:07

Full Disclosure
[Full Disclosure] CVE-2024-22903: Unpatched Command Injection in Vinchin Backup & Recovery Versions 7.2 and Earlier
January 26^th 2024 at 15:04

[Full Disclosure] CVE-2024-22903: Unpatched Command Injection in Vinchin Backup & Recovery Versions 7.2 and Earlier

Posted by Valentin Lobstein via Fulldisclosure on Jan 26

CVE ID: CVE-2024-22903

Title: Command Injection Vulnerability in SystemHandler.class.php of Vinchin Backup & Recovery Versions 7.2 and Earlier

Description:
A significant security vulnerability, CVE-2024-22903, has been identified in the `deleteUpdateAPK` function within the
`SystemHandler.class.php` file of Vinchin Backup & Recovery software, affecting versions 7.2 and earlier. This
function, designed to delete APK files, is prone to...

🏷️ My labels
- ❌
January 26^th 2024 at 15:04

Full Disclosure
[Full Disclosure] CVE-2024-22902: Default Root Credentials in Vinchin Backup & Recovery v7.2 and Earlier
January 26^th 2024 at 15:04

[Full Disclosure] CVE-2024-22902: Default Root Credentials in Vinchin Backup & Recovery v7.2 and Earlier

Posted by Valentin Lobstein via Fulldisclosure on Jan 26

CVE ID: CVE-2024-22902

Title: Default Root Credentials Vulnerability in Vinchin Backup & Recovery v7.2

Suggested Description:
Vinchin Backup & Recovery version 7.2 has been identified as being configured with default root credentials, posing a
significant security vulnerability.

Additional Information:
There is no documentation or guidance from Vinchin on changing the root password for this version. The use of password
authentication...

🏷️ My labels
- ❌
January 26^th 2024 at 15:04

Full Disclosure
[Full Disclosure] CVE-2024-22901: Default MYSQL Credentials in Vinchin Backup & Recovery v7.2 and Earlier
January 26^th 2024 at 15:04

[Full Disclosure] CVE-2024-22901: Default MYSQL Credentials in Vinchin Backup & Recovery v7.2 and Earlier

Posted by Valentin Lobstein via Fulldisclosure on Jan 26

CVE ID: CVE-2024-22901

Title: Default MYSQL Credentials Vulnerability in Vinchin Backup & Recovery v7.2

Description:
A critical security issue, identified as CVE-2024-22901, has been discovered in Vinchin Backup & Recovery version 7.2.
The software has been found to use default MYSQL credentials, which could lead to significant security risks.

Additional Information:
Vinchin has not addressed previous disclosures, including...

🏷️ My labels
- ❌
January 26^th 2024 at 15:04

Full Disclosure
Re: ODR violation in Redis Raft
January 18^th 2024 at 19:34

Re: ODR violation in Redis Raft

Posted by Jeffrey Walton on Jan 18

I fail to see how a One Definition Rule (ODR) violation results in a
Remote Code Execution.

Can you share your PoC, please?

Jeff

🏷️ My labels
- ❌
January 18^th 2024 at 19:34

Full Disclosure
Minor firefox DoS - semi silently polluting ~/Downloads with files (part 2)
January 18^th 2024 at 19:34

Minor firefox DoS - semi silently polluting ~/Downloads with files (part 2)

Posted by Georgi Guninski on Jan 18

Minor firefox DoS - semi silently polluting ~/Downloads with files (part 2)

Tested on: firefox 121 and chrome 120 on GNU/linux

Date: Thu Jan 18 08:38:28 AM UTC 2024

This is barely a DoS, but since it might affect Chrome too we decided
to disclose it.

If firefox user visits a specially crafted page, then firefox
may create many files in `~/Downloads`,
The user is notified about this in a small dialog, but there is
no option to stop the...

🏷️ My labels
- ❌
January 18^th 2024 at 19:34

Full Disclosure
Legends of IdleOn - I Reject Your RNG And Substitute My Own
January 17^th 2024 at 20:26

Legends of IdleOn - I Reject Your RNG And Substitute My Own

Posted by Soatok Dreamseeker on Jan 17

Hello Full Disclosure mailing list!

Legends of IdleOn is a popular free-to-play game on Android, iOS, Steam,
and Web. While playing around with it last year, I got curious and noticed
a trivial way to manipulate the random number generator.

After six months of radio silence from the developer, including asking the
Discord moderators for help getting the developer's attention, I've decided
to publish this publicly:...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Buffer over-read in dtls_sha256_update of TinyDTLS
January 17^th 2024 at 20:26

Buffer over-read in dtls_sha256_update of TinyDTLS

Posted by Meng Ruijie on Jan 17

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. A buffer over-read exists in the dtls_sha256_update
function. This bug allows remote attackers to cause a denial of service (crash) and possibly read sensitive information
by sending a malformed packet with an over-large fragment length field, due to servers incorrectly handling malformed
packets.

[Vulnerability Type]
Buffer Overflow

[Vendor of...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Misues same epoch number within TCP lifetime in TinyDTLS
January 17^th 2024 at 20:26

Misues same epoch number within TCP lifetime in TinyDTLS

Posted by Meng Ruijie on Jan 17

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. DTLS servers allow remote attackers to reuse the
same epoch number within two times the TCP maximum segment lifetime, which is prohibited in RFC6347. This vulnerability
allows remote attackers to obtain sensitive application (data of connected clients).

[VulnerabilityType Other]
Improper Handling of exception conditions

[Vendor of Product]...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Assertion failure in check_certificate_request() of TinyDTLS
January 17^th 2024 at 20:26

Assertion failure in check_certificate_request() of TinyDTLS

Posted by Meng Ruijie on Jan 17

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. An assertion failure in check_certificate_request()
causes the server to exit unexpectedly (a denial of service).

[VulnerabilityType Other]
Improper Handling of exception conditions

[Vendor of Product]
https://github.com/contiki-ng/tinydtls

[Affected Product Code Base]
contiki-ng tinydtls - master branch 53a0d97

[Affected Component]
the service of dtls...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Buffer over-read in TinyDTLS
January 17^th 2024 at 20:26

Buffer over-read in TinyDTLS

Posted by Meng Ruijie on Jan 17

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. Incorrect handling of over-large packets in
dtls_ccm_decrypt_message() causes a buffer over-read that can expose sensitive information.

[Vulnerability Type]
Buffer Overflow

[Vendor of Product]
https://github.com/contiki-ng/tinydtls

[Affected Product Code Base]
contiki-ng tinydtls - master branch 53a0d97

[Affected Component]
the service of dtls servers...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Infinite loop leading to buffer overflow in TinyDTLS
January 17^th 2024 at 20:26

Infinite loop leading to buffer overflow in TinyDTLS

Posted by Meng Ruijie on Jan 17

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. An infinite loop bug exists during the handling of a
ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed
ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all
resources) and a buffer over-read that can disclose sensitive...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Mishandle epoch number in TinyDTLS servers
January 17^th 2024 at 20:26

Mishandle epoch number in TinyDTLS servers

Posted by Meng Ruijie on Jan 17

About CVE-2021-42142:

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. DTLS servers mishandle the early use of a large
epoch number. This vulnerability allows remote attackers to cause a denial of service and false-positive packet drops.

[VulnerabilityType Other]
Improper Handling of exception conditions

[Vendor of Product]
https://github.com/contiki-ng/tinydtls

[Affected Product Code Base]...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Incorrect handshake in TinyDTLS
January 17^th 2024 at 20:26

Incorrect handshake in TinyDTLS

Posted by Meng Ruijie on Jan 17

About CVE-2021-42141:

[Suggested description]
An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with
different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause
denial of service.

[VulnerabilityType Other]
Improper Handling of exception conditions

[Vendor of Product]
https://github.com/contiki-ng/tinydtls

[Affected Product Code...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
ODR violation in Redis Raft
January 17^th 2024 at 20:26

ODR violation in Redis Raft

Posted by Meng Ruijie on Jan 17

[Suggested description]
Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component
hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/alloc.c.

[VulnerabilityType Other]
AddressSanitizer: odr-violation

[Vendor of Product]
Redis

[Affected Product Code Base]
raft - master-1b8bd86 to master-7b46079

[Affected Component]
affected executable

[Attack Type]
Remote

[Impact Code execution]
true

[Impact...

🏷️ My labels
- ❌
January 17^th 2024 at 20:26

Full Disclosure
Backdoor.Win32 Carbanak (Anunak) / Named Pipe Null DACL
January 15^th 2024 at 06:08

Backdoor.Win32 Carbanak (Anunak) / Named Pipe Null DACL

Posted by malvuln on Jan 14

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source:
https://malvuln.com/advisory/b8e1e5b832e5947f41fd6ae6ef6d09a1.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32 Carbanak (Anunak)
Vulnerability: Named Pipe Null DACL
Family: Carbanak
Type: PE32
MD5: b8e1e5b832e5947f41fd6ae6ef6d09a1
Vuln ID: MVID-2024-0667
Dropped files: AlhEXlUJ.exe, AlhEXlUJbVpfX1EMVw.bin
Disclosure: 01/09/2024...

🏷️ My labels
- ❌
January 15^th 2024 at 06:08

Full Disclosure
CyberDanube Security Research 20240109-0 | Multiple Vulnerabilities in JetNet Series
January 15^th 2024 at 06:08

CyberDanube Security Research 20240109-0 | Multiple Vulnerabilities in JetNet Series

Posted by Thomas Weber via Fulldisclosure on Jan 14

🏷️ My labels
- ❌
January 15^th 2024 at 06:08

Full Disclosure
Re: cpio privilege escalation vulnerability via setuid files in cpio archive
January 15^th 2024 at 06:08

Re: cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by Harry Sintonen via Fulldisclosure on Jan 14

Tar does set setuid bit, but tar is not vulnerable. This is not an attack.

The user is responsible for extracting the archives to secure location
and not letting other users access to insecure setuid binaries. See:

https://www.gnu.org/software/tar/manual/html_section/Security.html#Security-rules-of-thumb

These same security considerations also apply to cpio.

🏷️ My labels
- ❌
January 15^th 2024 at 06:08

Full Disclosure
Re: cpio privilege escalation vulnerability via setuid files in cpio archive
January 15^th 2024 at 06:08

Re: cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by Harry Sintonen via Fulldisclosure on Jan 14

So does for example tar. The same rules that apply to tar also apply to
cpio:

"Extract from an untrusted archive only into an otherwise-empty directory.
This directory and its parent should be accessible only to trusted users."

This is a user error, not a vulnerability in cpio.

🏷️ My labels
- ❌
January 15^th 2024 at 06:08

Full Disclosure
Re: cpio privilege escalation vulnerability via setuid files in cpio archive
January 15^th 2024 at 06:06

Re: cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by Georgi Guninski on Jan 14

Hi, thanks for the feedback :)

Which version of tar is vulnerable to this attack? I am pretty sure
this was fixed in tar and zip `long long` ago.

tar and zip on fedora 38 are definitely not vulnerable, they clear
the setuid bit.

I continue to suspect this is vulnerability because:
1. There is directory traversal protection for untrusted archives
2. tar and zip and not vulnerable

bash script for setuid files in tar:

#!/bin/bash

mkdir -p...

🏷️ My labels
- ❌
January 15^th 2024 at 06:06

Full Disclosure
Re: cpio privilege escalation vulnerability via setuid files in cpio archive
January 15^th 2024 at 06:05

Re: cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by fulldisclosure on Jan 14

Am 08.01.24 um 10:25 schrieb Georgi Guninski:

It's not a vulnerability, as

a) cpio archives must archive that flag as cpio is part of RPM packages
and those
must be able to contain setuid flags. Otherwise, you would need to add
chmod u+s cmds to any %POST
section. Breaking this, would invalidate so many existing packages =>
won't happen

note: initramfs makes use of cpio as well, but setuid is not needed
here, as it's...

🏷️ My labels
- ❌
January 15^th 2024 at 06:05

Full Disclosure
Re: [SBA-ADV-20220120-01] MOKOSmart MKGW1 Gateway Improper Session Management
January 15^th 2024 at 06:04

Re: [SBA-ADV-20220120-01] MOKOSmart MKGW1 Gateway Improper Session Management

Posted by SBA - Advisory via Fulldisclosure on Jan 14

MITRE assigned CVE-2023-51059 for this issue.

🏷️ My labels
- ❌
January 15^th 2024 at 06:04

Full Disclosure
cpio privilege escalation vulnerability via setuid files in cpio archive
January 8^th 2024 at 21:46

cpio privilege escalation vulnerability via setuid files in cpio archive

Posted by Georgi Guninski on Jan 08

cpio privilege escalation vulnerability via setuid files in cpio archive

Happy New Year, let in 2024 happiness be with you! :)

When extracting archives cpio (at least version 2.13) preserves
the setuid flag, which might lead to privilege escalation.

One example is r00t extracts to /tmp/ and scidiot runs /tmp/micq/backd00r
without further interaction from root.

We believe this is vulnerability, since directory traversal in cpio
is considered...

🏷️ My labels
- ❌
January 8^th 2024 at 21:46

Full Disclosure
OXAS-ADV-2023-0006: OX App Suite Security Advisory
January 8^th 2024 at 21:46

OXAS-ADV-2023-0006: OX App Suite Security Advisory

Posted by Martin Heiland via Fulldisclosure on Jan 08

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at https://documentation.open-xchange.com/security/advisories/.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Internal reference: MWB-2315
Type:...

🏷️ My labels
- ❌
January 8^th 2024 at 21:46

Full Disclosure
OXAS-ADV-2023-0005: OX App Suite Security Advisory
January 8^th 2024 at 21:45

OXAS-ADV-2023-0005: OX App Suite Security Advisory

Posted by Martin Heiland via Fulldisclosure on Jan 08

Dear subscribers,

We're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at YesWeHack.

This advisory has also been published at https://documentation.open-xchange.com/security/advisories/.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Internal reference: MWB-2261
Type:...

🏷️ My labels
- ❌
January 8^th 2024 at 21:45

Full Disclosure
SSH-Snake: Automated SSH-Based Network Traversal
January 8^th 2024 at 21:45

SSH-Snake: Automated SSH-Based Network Traversal

Posted by Joshua Rogers on Jan 08

SSH-Snake is a powerful tool designed to perform automatic network
traversal using SSH private keys discovered on systems, with the objective
of creating a comprehensive map of a network and its dependencies,
identifying to what extent a network can be compromised using SSH and SSH
private keys starting from a particular system.

SSH-Snake can automatically reveal the relationship between systems which
are connected via SSH, which would normally...

🏷️ My labels
- ❌
January 8^th 2024 at 21:45

Full Disclosure
RansomLord v2 - Anti-Ransomware Exploitation Tool / New Release
January 4^th 2024 at 23:10

RansomLord v2 - Anti-Ransomware Exploitation Tool / New Release

Posted by hyp3rlinx on Jan 04

RansomLord v2 - Anti-Ransomware Exploitation Tool

[Description]
RansomLord is a proof-of-concept Anti-Ransomware exploitation tool that
generates PE files, used to exploit vulnerable Ransomware pre-encryption.

Lang: C

SHA256 : 8EA83752C4096C778709C14B60B9735CC68A5971DCDB0028A0BB167550554769

This version now intercepts and terminates malware tested from 43 different
threat groups.
Adding Wagner, Hakbit, Paradise, Jaff, DoubleZero, Blacksnake,...

🏷️ My labels
- ❌
January 4^th 2024 at 23:10

Full Disclosure
Windows PowerShell Single Quote Code Execution / Event Log Bypass
January 4^th 2024 at 23:10

Windows PowerShell Single Quote Code Execution / Event Log Bypass

Posted by hyp3rlinx on Jan 04

[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:
http://hyp3rlinx.altervista.org/advisories/WINDOWS_POWERSHELL_SINGLE_QUOTE_CODE_EXEC_EVENT_LOG_BYPASS.txt
[+] twitter.com/hyp3rlinx
[+] twitter.com/malvuln
[+] ISR: ApparitionSec

[Vendor]
www.microsoft.com

[Product]
Microsoft Windows PowerShell

Built on the . NET Framework, Windows PowerShell helps IT professionals and
power users control and automate the...

🏷️ My labels
- ❌
January 4^th 2024 at 23:10

Full Disclosure
[ES2023-02] FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation
December 26^th 2023 at 15:38

[ES2023-02] FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation

Posted by Sandro Gauci on Dec 26

# FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation

- Fixed versions: 1.10.11
- Enable Security Advisory:
https://github.com/EnableSecurity/advisories/tree/master/ES2023-02-freeswitch-dtls-hello-race
- Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-39gv-hq72-j6m6
- Other references: CVE-2023-51443
- Tested vulnerable versions: 1.10.10
- Timeline:
-...

🏷️ My labels
- ❌
December 26^th 2023 at 15:38

Full Disclosure
asterisk release 20.5.1
December 19^th 2023 at 22:18

asterisk release 20.5.1

Posted by Asterisk Development Team via Fulldisclosure on Dec 19

The Asterisk Development Team would like to announce security release
Asterisk 20.5.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/20.5.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

The following security advisories were resolved in this release:
- [Path traversal via AMI GetConfig allows access to outside
files](...

🏷️ My labels
- ❌
December 19^th 2023 at 22:18

Full Disclosure
asterisk release 18.20.1
December 19^th 2023 at 22:17

asterisk release 18.20.1

Posted by Asterisk Development Team via Fulldisclosure on Dec 19

The Asterisk Development Team would like to announce security release
Asterisk 18.20.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/18.20.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

The following security advisories were resolved in this release:
- [Path traversal via AMI GetConfig allows access to outside
files](...

🏷️ My labels
- ❌
December 19^th 2023 at 22:17

Full Disclosure
CORRECTED asterisk release 21.0.1
December 19^th 2023 at 22:17

CORRECTED asterisk release 21.0.1

Posted by Asterisk Development Team on Dec 19

The earlier announcement should not have had any User or Upgrade notes.

The Asterisk Development Team would like to announce security release
Asterisk 21.0.1.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/21.0.1
and
https://downloads.asterisk.org/pub/telephony/asterisk

The following security advisories were resolved in this release:
- [Path traversal via AMI GetConfig allows...

🏷️ My labels
- ❌
December 19^th 2023 at 22:17

Full Disclosure
CORRECTED asterisk release certified-18.9-cert6
December 19^th 2023 at 22:17

CORRECTED asterisk release certified-18.9-cert6

Posted by Asterisk Development Team on Dec 19

The earlier release announcement should NOT have had any User or Upgrade
notes.

The Asterisk Development Team would like to announce security release
Certified Asterisk 18.9-cert6.

The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert6
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk

The following security advisories were resolved in this release:...

🏷️ My labels
- ❌
December 19^th 2023 at 22:17

Full Disclosure
[ES2023-03] RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation
December 19^th 2023 at 22:16

[ES2023-03] RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation

Posted by Sandro Gauci on Dec 19

# RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation

- Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2
- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race
- Vendor Patch: https://github.com/sipwise/rtpengine/commit/e969a79428ac4a15cdf1c0a1c6f266dbdc7e60b6
- Tested vulnerable versions: mr11.5.1.6
- Timeline:...

🏷️ My labels
- ❌
December 19^th 2023 at 22:16

Full Disclosure
[ES2023-01] Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
December 19^th 2023 at 22:16

[ES2023-01] Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation

Posted by Sandro Gauci on Dec 19

# Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation

- Fixed versions: 18.20.1, 20.5.1, 21.0.1,18.9-cert6
- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-01-asterisk-dtls-hello-race
- Vendor Security Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq
- Other references: CVE-2023-49786
- Tested vulnerable versions: 20.1.0
-...

🏷️ My labels
- ❌
December 19^th 2023 at 22:16

Full Disclosure
[KIS-2023-14] PKP-WAL <= 3.4.0-3 (NativeImportExportPlugin) Remote Code Execution Vulnerability
December 19^th 2023 at 22:15

[KIS-2023-14] PKP-WAL <= 3.4.0-3 (NativeImportExportPlugin) Remote Code Execution Vulnerability

Posted by Egidio Romano on Dec 19

---------------------------------------------------------------------------------
PKP-WAL <= 3.4.0-3 (NativeImportExportPlugin) Remote Code Execution
Vulnerability
---------------------------------------------------------------------------------

[-] Software Links:

https://pkp.sfu.ca
https://github.com/pkp/pkp-lib

[-] Affected Versions:

PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-3
and prior versions, as used in Open...

🏷️ My labels
- ❌
December 19^th 2023 at 22:15

Full Disclosure
[SBA-ADV-20220120-01] MOKOSmart MKGW1 Gateway Improper Session Management
December 19^th 2023 at 22:15

[SBA-ADV-20220120-01] MOKOSmart MKGW1 Gateway Improper Session Management

Posted by SBA - Advisory via Fulldisclosure on Dec 19

# MOKOSmart MKGW1 Gateway Improper Session Management #

Link:
https://github.com/sbaresearch/advisories/tree/public/2022/SBA-ADV-20220120-01_MOKOSmart_MKGW1_Gateway_Improper_Session_Management

## Vulnerability Overview ##

MOKOSmart MKGW1 Gateway devices with firmware version 1.1.1 or below do
not provide an adequate session management for the administrative web
interface. This allows adjacent attackers with access to the management
network to...

🏷️ My labels
- ❌
December 19^th 2023 at 22:15

Full Disclosure
APPLE-SA-12-19-2023-1 macOS Sonoma 14.2.1
December 19^th 2023 at 22:15

APPLE-SA-12-19-2023-1 macOS Sonoma 14.2.1

Posted by Apple Product Security via Fulldisclosure on Dec 19

APPLE-SA-12-19-2023-1 macOS Sonoma 14.2.1

macOS Sonoma 14.2.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/kb/HT214048.

Apple maintains a Security Updates page at
https://support.apple.com/HT201222 which lists recent
software updates with security advisories.

WindowServer
Available for: macOS Sonoma
Impact: A user who shares their screen may unintentionally share the...

🏷️ My labels
- ❌
December 19^th 2023 at 22:15

Full Disclosure
Disclosure of CVE-2023-50917: RCE Vulnerability in MajorDoM
December 19^th 2023 at 22:14

Disclosure of CVE-2023-50917: RCE Vulnerability in MajorDoM

Posted by Balgogan via Fulldisclosure on Dec 19

**Introduction**

MajorDoMo, a beacon in Russian home automation and particularly favored by Raspberry Pi aficionados, has been a trusted
name for over a decade. With over 380 stars on its official GitHub repository at the time of writing
(https://github.com/sergejey/majordomo), its popularity is evident. However, lurking within its `thumb.php` module is a
severe unauthenticated Remote Code Execution (RCE) vulnerability before 0662e5e.
NOTE:...

🏷️ My labels
- ❌
December 19^th 2023 at 22:14

Full Disclosure
SEC Consult SA-20231211-0 :: Local Privilege Escalation via MSI installer in PDF24 Creator
December 12^th 2023 at 23:22

SEC Consult SA-20231211-0 :: Local Privilege Escalation via MSI installer in PDF24 Creator

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231211-0 >
=======================================================================
title: Local Privilege Escalation via MSI installer
product: PDF24 Creator (geek Software GmbH)
vulnerable version: <=11.15.1
fixed version: 11.15.2
CVE number: CVE-2023-49147
impact: High
homepage:...

🏷️ My labels
- ❌
December 12^th 2023 at 23:22

Full Disclosure
SEC Consult SA-20231206 :: Kiosk Escape Privilege Escalation in One Identity Password Manager Secure Password Extension
December 12^th 2023 at 23:22

SEC Consult SA-20231206 :: Kiosk Escape Privilege Escalation in One Identity Password Manager Secure Password Extension

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231206-0 >
=======================================================================
title: Kiosk Escape Privilege Escalation
product: One Identity Password Manager Secure Password Extension
vulnerable version: <5.13.1
fixed version: 5.13.1
CVE number: CVE-2023-48654
impact: critical
homepage:...

🏷️ My labels
- ❌
December 12^th 2023 at 23:22

SEC Consult SA-20231205 :: Argument injection leading to unauthenticated RCE and authentication bypass in Atos Unify OpenScape Session Border Controller (SBC), Branch, BCF

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231205-0 >
=======================================================================
title: Argument injection leading to unauthenticated RCE and
authentication bypass
product: Atos Unify OpenScape Session Border Controller (SBC)
Atos Unify OpenScape Branch
Atos Unify OpenScape BCF
vulnerable...

🏷️ My labels
- ❌
December 12^th 2023 at 23:22

Full Disclosure
SEC Consult SA-20231128 :: Missing Certificate Validation & User Enumeration in Anveo Mobile App and Server
December 12^th 2023 at 23:22

SEC Consult SA-20231128 :: Missing Certificate Validation & User Enumeration in Anveo Mobile App and Server

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Dec 12

SEC Consult Vulnerability Lab Security Advisory < 20231128-0 >
=======================================================================
title: Missing Certificate Validation & User Enumeration
product: Anveo Mobile App and Server
vulnerable version: Mobile App: 10.0.0.359 / 2016-07-13; Server: 11.0.0.5
fixed version: -
CVE number: -
impact: Medium
homepage:...

🏷️ My labels
- ❌
December 12^th 2023 at 23:22

Full Disclosure
HNS-2023-04 - HN Security Advisory - Buffer overflow vulnerabilities with long path names in TinyDir
December 12^th 2023 at 23:21

HNS-2023-04 - HN Security Advisory - Buffer overflow vulnerabilities with long path names in TinyDir

Posted by Marco Ivaldi on Dec 12

Hi,

Please find attached a security advisory that describes some buffer
overflow vulnerabilities we discovered in TinyDir.

* Title: Buffer overflow vulnerabilities with long path names in TinyDir
* Product: TinyDir <= 1.2.5
* Author: Marco Ivaldi <marco.ivaldi () hnsecurity it>
* Date: 2023-12-04
* CVE ID: CVE-2023-49287
* Severity: High - 7.7 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
* Vendor URL: https://github.com/cxong/tinydir...

🏷️ My labels
- ❌
December 12^th 2023 at 23:21

APPLE-SA-12-11-2023-8 watchOS 10.2