Apple Security Advisory

macOS Monterey 12.6.7 Security Content Safari 16.5.1 Security Content watchOS 8.8.1 Security Content watchOS 9.5.2 Security Content macOS Big Sur 11.7.8 Security Content macOS Ventura 13.4.1 Security Content iOS 15.7.7 and iPadOS 15.7.7 Security Content iOS 16.5.1 and iPadOS 16.5.1 Security Content

National Cyber Awareness System

CISA Adds Five Known Exploited Vulnerabilities to Catalog VMware Releases Security Update for vCenter Server and Cloud Foundation Apple Releases Security Updates for Multiple Products Juniper Networks Releases Security Advisory for Junos OS and Junos OS Evolved ISC Releases Security Advisories for Multiple Versions of BIND 9 CISA Releases Four Industrial Control Systems Advisories

Ubuntu Security Notices

.NET regression: USN-6161-2 OpenSSL vulnerability: USN-6188-1 CUPS vulnerability: USN-6184-1 Linux kernel (IBM) vulnerabilities: USN-6187-1 Linux kernel vulnerabilities: USN-6186-1 / USN-6185-1 Bind vulnerabilities: USN-6183-1 LSN-0095-1: Kernel Live Patch Security Notice pngcheck vulnerabilities: USN-6182-1 Ruby vulnerabilities: USN-6181-1 Firefox regressions: USN-6143-3 Werkzeug vulnerabilities: USN-5948-2 VLC media player vulnerabilities: USN-6180-1 libx11 vulnerability: USN-6168-2 Jettison vulnerability: USN-6179-1 SVG++ library vulnerabilities: USN-6178-1 cups-filters vulnerability: USN-6083-2 libcap2 vulnerability: USN-6166-2 Jettison vulnerabilities: USN-6177-1 PyPDF2 vulnerability: USN-6176-1 QEMU vulnerabilities: USN-6167-1

Red Hat Security Advisory

Important: OpenShift Container Platform 4.10.62 security update: RHSA-2023:3625 Important: OpenShift Container Platform 4.13.4 packages and security update: RHSA-2023:3612 Moderate: OpenShift Container Platform 4.12.22 bug fix and security update: RHSA-2023:3615 Important: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update: RHSA-2023:3742 Important: python38:3.8 and python38-devel:3.8 security update: RHSA-2023:3781 Important: python27:2.7 security update: RHSA-2023:3780 / RHSA-2023:3777 Important: python39:3.9 and python39-devel:3.9 security update: RHSA-2023:3776 Moderate: OpenShift Container Platform 4.13.4 bug fix and security update: RHSA-2023:3614 Important: Red Hat Virtualization security and bug fix update: RHSA-2023:3771 Moderate: OpenShift Container Platform 4.13.4 CNF vRAN extras security update: RHSA-2023:3342 Important: c-ares security update: RHSA-2023:3741 / RHSA-2023:3677 / RHSA-2023:3665 / RHSA-2023:3662 / RHSA-2023:3660 Important: Red Hat Integration Camel for Spring Boot 3.20.1 Patch 1 release security update: RHSA-2023:3740 Important: kpatch-patch security update: RHSA-2023:3705 Moderate: Red Hat Integration Camel Extensions for Quarkus 2.13.3 security update: RHSA-2023:3667 Moderate: OpenShift Jenkins image and Jenkins agent base image security update: RHSA-2023:3664 Important: jenkins and jenkins-2-plugins security update: RHSA-2023:3663 Important: texlive security update: RHSA-2023:3661

Github Security Advisories

[GHSA-3g7p-8qhx-mc8r] Shescape potential environment variable exposure on Windows with CMD [GHSA-5f9v-mv5g-jh5q] Vaadin vulnerable to possible information disclosure in non visible components. [GHSA-ch48-9r3q-pv7x] Vaadin vulnerable to possible information disclosure of class and method names in RPC response [GHSA-whj9-m24x-qhhp] FastAsyncWorldEdit vulnerable to Uncontrolled Resource Consumption [GHSA-4xm7-5q79-3fch] XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page [GHSA-r8xc-xxh3-q5x3] XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template [GHSA-x234-mg7q-m8g8] XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template [GHSA-mwxj-g7fw-7hc8] XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template [GHSA-phwm-87rg-27qq] XWiki Platform vulnerable to reflected cross-site scripting via delattachment action [GHSA-834c-x29c-f42c] XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in delete template [GHSA-jhpr-j7cq-3jp3] Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error [GHSA-9849-p7jc-9rmv] org.nokogiri:nekohtml vulnerable to Uncontrolled Resource Consumption [GHSA-8jxm-xp43-qh3q] Silver vulnerable to MitM attack against implants due to a cryptography vulnerability [GHSA-564w-97r7-c6p9] Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows [GHSA-5wrg-8fxp-cx9r] passport-wsfed-saml2 Signature Bypass vulnerability [GHSA-wg6p-jmpc-xjmr] Backstage Scaffolder plugin has insecure sandbox [GHSA-77fw-rf4v-vfp9] passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token [GHSA-47p7-xfcc-4pv9] php-imap vulnerable to RCE through a directory traversal vulnerability [GHSA-wmff-grcw-jcfm] Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles [GHSA-h7cw-44vp-jq7h] XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanel [GHSA-7hh3-3x64-v2g9] When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id [GHSA-q9hg-9qj2-mxf9] XPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in previewactions template [GHSA-fwwj-wg89-7h4c] XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email [GHSA-4wc6-hqv9-qc97] XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters [GHSA-rf8j-q39g-7xfm] XWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults [GHSA-8g9c-c9cm-9c56] XWiki Platform may show email addresses in clear in REST results [GHSA-6mf5-36v9-3h2w] XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application [GHSA-7vr7-cghh-ch63] XWiki Platform may retrieve email addresses of all users [GHSA-7f2f-pcv3-j2r7] XWiki Platform's tags on non-viewable pages can be revealed to users [GHSA-g75c-cjr6-39mc] XWiki Platform's Mail.MailConfig can be edited by any user with edit rights [GHSA-fp7h-f9f5-x4q7] XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template [GHSA-8rc9-vxjh-qjf2] Vega's validators able to submit duplicate transactions [GHSA-6mjq-h674-j845] netty-handler SniHandler 16MB allocation [GHSA-rx28-r23p-2qc3] AWS CDK EKS overly permissive trust policies [GHSA-wprv-93r4-jj2p] OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees

CISA Known Exploted Vulnerabilities

Vmware Aria Operations for Networks Command Injection Vulnerability CVE-2023-20887 Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability CVE-2020-35730 Roundcube Webmail Remote Code Execution Vulnerability CVE-2020-12641 Roundcube Webmail SQL Injection Vulnerability CVE-2021-44026 Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability CVE-2016-9079 Microsoft Win32k Privilege Escalation Vulnerability CVE-2016-0165 Apple Multiple Products Integer Overflow Vulnerability CVE-2023-32434 Apple iOS and iPadOS WebKit Memory Corruption Vulnerability CVE-2023-32435 Apple Multiple Products WebKit Type Confusion Vulnerability CVE-2023-32439 VMware Tools Authentication Bypass Vulnerability CVE-2023-20867 Zyxel Multiple NAS Devices Command Injection Vulnerability CVE-2023-27992

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.