National Cyber Awareness System

Progress Software Releases Service Pack for MOVEit Transfer Vulnerabilities CISA Adds One Known Vulnerability to Catalog CISA Releases Three Industrial Control Systems Advisories CISA and Partners Release Joint Cybersecurity Advisory on Newly Identified Truebot Malware Variants Mozilla Releases Security Advisories for Thunderbird, Firefox, and Firefox ESR

Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 102.13 mfsa2023-24 Security Vulnerabilities fixed in Firefox ESR 102.13 mfsa2023-23 Security Vulnerabilities fixed in Firefox 115 mfsa2023-22

Ubuntu Security Notices

Linux kernel (Intel IoTG) vulnerabilities: USN-6212-1 / USN-6207-1 Linux kernel (Azure) regression: USN-6211-1 Doorkeeper vulnerability: USN-6210-1 Gorilla WebSocket vulnerability: USN-6208-1 Linux kernel (OEM) vulnerabilities: USN-6206-1 Linux kernel (GKE) vulnerabilities: USN-6205-1 CPDB vulnerability: USN-6204-1 Django vulnerability: USN-6203-1 containerd vulnerabilities: USN-6202-1 Firefox vulnerabilities: USN-6201-1 ImageMagick vulnerabilities: USN-6200-1 PHP vulnerability: USN-6199-1 GNU Screen vulnerability: USN-6198-1 OpenLDAP vulnerability: USN-6197-1 ReportLab vulnerability: USN-6196-1 Vim vulnerabilities: USN-6195-1

Red Hat Security Advisory

Moderate: OpenShift Container Platform 4.12.23 security update: RHSA-2023:3924 Moderate: Red Hat OpenShift Enterprise security update: RHSA-2023:3925 Important: Red Hat OpenShift Enterprise security update: RHSA-2023:3910 / RHSA-2023:3914 Important: OpenShift Container Platform 4.10.63 security update: RHSA-2023:3911 Important: OpenShift Container Platform 4.11.44 bug fix and security update: RHSA-2023:3915

Github Security Advisories

[GHSA-wjw2-4j7j-6gc3] Winter CMS stored XSS through privileged upload of SVG file [GHSA-f7xj-rg7h-mc87] Stylelint has vulnerability in semver dependency [GHSA-w2h3-vvvq-3m53] Pipelines do not validate child UIDs [GHSA-j2cr-jc39-wpx5] Barberry Security Advisory - regarding x/auth periodic vesting accounts [GHSA-4xqm-4p72-87h6] Sentry CORS misconfiguration [GHSA-wj7q-gjg8-3cpm] league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase [GHSA-jqhc-m2j3-fjrx] SQLFluff users with access to config file, using `libary_path` may call arbitrary python code [GHSA-6r5g-cq4q-327g] Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG [GHSA-2q4p-f6gf-mqr5] Graylog server has partial path traversal vulnerability in Support Bundle feature [GHSA-g96c-x7rh-99r3] Graylog vulnerable to insecure source port usage for DNS queries [GHSA-3fqm-frhg-7c85] Graylog user session is still usable after logout [GHSA-r25m-cr6v-p9hq] ethyca-fides Webserver API Path Traversal vulnerability [GHSA-v8mc-9377-rwjj] yt-dlp File Downloader cookie leak [GHSA-f5ww-cq3m-q3g7] Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content [GHSA-gm68-572p-q28r] @vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability [GHSA-4hpj-8rhv-9x87] Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module [GHSA-jpgw-2r9m-8qfw] Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox [GHSA-qxh3-jgvh-x55j] Connect-CMS Privilege Escalation Vulnerability [GHSA-7x2c-fgx6-xf9h] 1Panel vulnerable to ommand injection when entering the container terminal [GHSA-q2mx-gpjf-3h8x] 1Panel vulnerable to command injection when adding container repositories [GHSA-g8x5-p9qc-cf95] @fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state [GHSA-x456-3ccm-m6j4] MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form [GHSA-w24w-wp77-qffm] CometBFT may duplicate transactions in the mempool's data structures [GHSA-mvj3-qrqh-cjvr] CometBFT PeerState JSON serialization deadlock

CISA Known Exploted Vulnerabilities

Arm Mali GPU Kernel Driver Use-After-Free Vulnerability CVE-2021-29256

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.