Apple Security Advisory

iOS 16.6 and iPadOS 16.6 Security Content Safari 16.6 Security Content watchOS 9.6 Security Content tvOS 16.6 Security Content macOS Big Sur 11.7.9 Security Content macOS Monterey 12.6.8 Security Content macOS Ventura 13.5 Security Content iOS 15.7.8 and iPadOS 15.7.8 Security Content

National Cyber Awareness System

CISA Releases Malware Analysis Reports on Barracuda Backdoors Ivanti Releases Security Updates for EPMM to address CVE-2023-35081 CISA and Partners Release Joint Cybersecurity Advisory on Preventing Web Application Access Control Abuse CISA Adds One Known Exploited Vulnerability to Catalog CISA Releases Five Industrial Control Systems Advisories CISA Releases Analysis of FY22 Risk and Vulnerability Assessments CISA Adds One Known Exploited Vulnerability to Catalog CISA Releases Four Industrial Control Systems Advisories Apple Releases Security Updates for Multiple Products CISA Adds One Known Exploited Vulnerability to Catalog Ivanti Releases Security Updates for Endpoint Manager Mobile (EPMM) CVE-2023-35078

Ubuntu Security Notices

Linux kernel (IoT) vulnerabilities: USN-6261-1 / USN-6256-1 Linux kernel vulnerabilities: USN-6260-1 / USN-6254-1 / USN-6252-1 / USN-6251-1 / USN-6250-1 / USN-6246-1 Open-iSCSI vulnerabilities: USN-6259-1 X.Org X Server vulnerabilities: USN-5193-3 LLVM Toolchain vulnerabilities: USN-6258-1 Open VM Tools vulnerability: USN-6257-1 Linux kernel (Intel IoTG) vulnerabilities: USN-6255-1 libvirt vulnerability: USN-6253-1 libXpm vulnerability: USN-5807-3 Linux kernel (OEM) vulnerabilities: USN-6249-1 / USN-6248-1 / USN-6247-1 Trove vulnerabilities: USN-6245-1 AMD Microcode vulnerability: USN-6244-1 Avahi vulnerability: USN-6129-2 Django vulnerability: USN-6203-2 LSN-0096-1: Kernel Live Patch Security Notice Graphite-Web vulnerabilities: USN-6243-1 OpenSSH vulnerability: USN-6242-1 OpenStack vulnerability: USN-6241-1 FRR vulnerability: USN-6240-1

Red Hat Security Advisory

Moderate: rh-postgresql12-postgresql security update: RHSA-2023:4313 Moderate: Migration Toolkit for Containers (MTC) 1.7.11 security and bug fix update: RHSA-2023:4293 Moderate: OpenShift Container Platform 4.13.6 bug fix and security update: RHSA-2023:4226 Moderate: OpenShift sandboxed containers 1.4.1 security update: RHSA-2023:4290 Important: OpenShift API for Data Protection (OADP) 1.0.11 security and bug fix update: RHSA-2023:4289 Moderate: OpenShift Container Platform 4.13.6 security and extras update: RHSA-2023:4225 Moderate: Red Hat OpenShift Data Foundation 4.12.5 security and bug fix update: RHSA-2023:4287 Moderate: Red Hat OpenShift Dev Spaces Security Update: RHSA-2023:4286 Moderate: Red Hat OpenStack Platform 16.2 (openstack-neutron) security update: RHSA-2023:4283 Important: Red Hat Virtualization Host 4.4.z SP 1 security update: RHSA-2023:4282 Moderate: DevWorkspace Operator Security Update: RHSA-2023:4276 Important: edk2 security update: RHSA-2023:4252

Cisco Security Advisory

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software ACLs Not Installed upon Reload

Amazon AWS Security Advisories

CVE-2023-20593

Github Security Advisories

[GHSA-68p4-95xf-7gx8] Denial of service from large image [GHSA-x5mr-p6v4-wp93] Field injection in the KirbyData text storage handler [GHSA-5mvj-rvp8-rf45] Insufficient Session Expiration after a password change [GHSA-q386-w6fg-gmgp] XML External Entity (XXE) vulnerability in the XML data handler [GHSA-8fv7-wq38-f5c9] Cross-site scripting (XSS) from MIME type auto-detection of uploaded files [GHSA-3v6j-v3qc-cxff] Denial of service from unlimited password lengths [GHSA-pj4x-2xr5-w87m] Possible image tampering from missing image validation for Packages [GHSA-8www-cffh-4q98] Anyone with a share link can RESET all website data in Umami [GHSA-g9w4-prf3-m25g] Obfuscated email addresses should not be sorted [GHSA-wxf3-4fvj-vqqx] Unsafe plugins can be installed via pack import by tenant admins [GHSA-gpw9-fwm8-7rx7] DoS vulnerability for apps with sockets enabled [GHSA-gggm-66rh-pp98] Incorrect Permission Checking for GraphQL Subscriptions [GHSA-m8fw-p3cr-6jqc] Cross-Site Scripting in CKEditor4 WordCount Plugin [GHSA-59jf-3q9v-rh6g] By-passing Cross-Site Scripting Protection in HTML Sanitizer [GHSA-jq6g-4v5m-wm9r] Information Disclosure due to Out-of-scope Site Resolution [GHSA-wvp2-9ppw-337j] Paths contain matrix variables bypass decorators [GHSA-4qcv-qf38-5j3j] Unintentional leakage of private information via cross-origin websocket session hijacking [GHSA-f54q-j679-p9hh] Reflected cross-site scripting via k304 parameter [GHSA-f5x6-7qgp-jhf3] ecrecover can return undefined data if signature does not verify [GHSA-wh3p-fphp-9h2m] Arbitrary File Creation in AbstractUnArchiver [GHSA-m4hc-m2v6-hfw8] Improper authorization on debug and artifact file downloads [GHSA-4gpr-p634-922x] Cross site scripting via input unit widget [GHSA-9xg4-3qfm-9w8f] Leaking sensitive user information still possible by filtering on private with prefix fields [GHSA-chmr-rg2f-9jmf] Making all attributes on a content-type public without noticing it [GHSA-m8v7-469p-5x89] Hard-coded System User Credentials in Folio Data Export Spring module [GHSA-xqr8-7jwr-rhp7] Removal of e-Tugra root certificate [GHSA-vh2g-6c4x-5hmp] Path traversal and code execution via prototype vulnerability [GHSA-vf78-3q9f-92g3] Hard-coded System User Credentials in Folio Data Export Spring module [GHSA-mmx5-32m4-wxvx] Ineffective privileges drop when requesting container network [GHSA-rfhg-rjfp-9q8q] Potential denial of service after connection migration

CISA Known Exploted Vulnerabilities

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability CVE-2023-35078 Apple Multiple Products Kernel Unspecified Vulnerability CVE-2023-38606 Zimbra Collaboration (ZCS) Cross-Site Scripting (XSS) Vulnerability CVE-2023-37580

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.