Posted by Stefan Kanthak on Jun 07
Hi @ll,
about a month ago Microsoft published HVCIScan-{amd,arm}64.exe, a
“Tool to check devices for compatibility with memory integrity (HVCI)”
The “Install instructions” on the download page
<https://www.microsoft.com/en-us/download/105217> tell:
| Download the hvciscan.exe for your system architecture (AMD64 or ARM64).
| From an elevated command window or PowerShell, run hvciscan.exe
“ELEVATED” sounds…
Posted by Qualys Security Advisory via Fulldisclosure on Jun 07
Qualys Security Advisory
LPE and RCE in RenderDoc: CVE-2023-33865, CVE-2023-33864, CVE-2023-33863
========================================================================
Contents
========================================================================
Summary
CVE-2023-33865, a symlink vulnerability in /tmp/RenderDoc
– Analysis
– Exploitation
CVE-2023-33864, an integer underflow to heap-based buffer overflow
– Analysis
– Exploitation…
A denial of service issue was discovered in GitLab CE/EE affecting all versions starting from 13.2.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2 which allows an attacker to cause high resource consumption using malicious test report artifacts.
matrix-synapse-1.85.1-1.fc38
Update to v1.85.1
Update to v1.85.0
Fixes CVE-2023-32682, CVE-2023-32683
Update to v1.84.1
The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-31693.
VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS.
It was discovered that Sysstat incorrectly handled certain arithmetic
multiplications. An attacker could use this issue to cause Sysstat to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue was only fixed for Ubuntu 16.04 LTS. (CVE-2022-39377)
It was discovered that Sysstat incorrectly handled certain arithmetic
multiplications in 64-bit systems, as a result of an incomplete fix for
CVE-2022-39377. An attacker could use this issue to cause Sysstat to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2023-33204)
python3.7-3.7.16-4.fc38
Fix for CVE-2023-24329
python3.7-3.7.16-2.fc37
Fix for CVE-2023-24329
The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
