National Cyber Awareness System

CISA’s VDP Platform 2022 Annual Report Showcases Success CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA Releases Six Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog CISA Releases Four Industrial Control Systems Advisories CISA Adds One Known Exploited Vulnerability to Catalog CISA, NSA, and NIST Publish Factsheet on Quantum Readiness

Ubuntu Security Notices

JOSE for C/C++ vulnerability: USN-6307-1 Fast DDS vulnerabilities: USN-6306-1 PHP vulnerabilities: USN-6305-1 Inetutils vulnerabilities: USN-6304-1 ClamAV vulnerability: USN-6303-2 / USN-6303-1 Vim vulnerabilities: USN-6302-1 Firefox regressions: USN-6267-3

Red Hat Security Advisory

Moderate: OpenShift Container Platform 4.12.30 packages and security update: RHSA-2023:4674 Moderate: OpenShift Container Platform 4.12.30 bug fix and security update: RHSA-2023:4671 Moderate: AMQ Broker 7.11.1.OPR.2.GA Container Images Release: RHSA-2023:4720 Moderate: Secondary Scheduler Operator for Red Hat OpenShift 1.1.2 security update: RHSA-2023:4657 Important: subscription-manager security update: RHSA-2023:4708 / RHSA-2023:4707 / RHSA-2023:4706 / RHSA-2023:4704 / RHSA-2023:4703 / RHSA-2023:4702 Moderate: subscription-manager security update: RHSA-2023:4701 Important: kernel security update: RHSA-2023:4699 / RHSA-2023:4697 / RHSA-2023:4696 Moderate: Release of containers for OSP 16.2.z (Train) director Operator: RHSA-2023:4694 Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update: RHSA-2023:4693 / RHSA-2023:4692

Cisco Security Advisory

Cisco NX-OS Software TACACS+ or RADIUS Remote Authentication Directed Request Denial of Service Vulnerability Cisco Nexus 3000 and 9000 Series Switches SFTP Server File Access Vulnerability Cisco FXOS Software Arbitrary File Write Vulnerability Cisco Firepower 4100 Series, Firepower 9300 Security Appliances, and UCS 6300 Series Fabric Interconnects SNMP Denial of Service Vulnerability Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol Denial of Service Vulnerability Cisco Application Policy Infrastructure Controller Unauthorized Policy Actions Vulnerability

Microsoft Security

Microsoft August 2023 Security Update Guide Chromium: CVE-2023-4431: Out of bounds memory access in Fonts Chromium: CVE-2023-4430: Use after free in Vulkan Chromium: CVE-2023-4429: Use after free in Loader Chromium: CVE-2023-4428: Out of bounds memory access in CSS Chromium: CVE-2023-4427: Out of bounds memory access in V8 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability: CVE-2023-36741 Chromium: CVE-2023-4349 Use after free in Device Trust Connectors Chromium: CVE-2023-2312 Use after free in Offline Chromium: CVE-2023-4352 Type Confusion in V8 Chromium: CVE-2023-4350 Inappropriate implementation in Fullscreen Chromium: CVE-2023-4358 Use after free in DNS Chromium: CVE-2023-4367 Insufficient policy enforcement in Extensions API Chromium: CVE-2023-4359 Inappropriate implementation in App Launcher Chromium: CVE-2023-4360 Inappropriate implementation in Color Chromium: CVE-2023-4361 Inappropriate implementation in Autofill Chromium: CVE-2023-4362 Heap buffer overflow in Mojom IDL Chromium: CVE-2023-4363 Inappropriate implementation in WebShare Chromium: CVE-2023-4364 Inappropriate implementation in Permission Prompts Chromium: CVE-2023-4365 Inappropriate implementation in Fullscreen Chromium: CVE-2023-4366 Use after free in Extensions Chromium: CVE-2023-4351 Use after free in Network Chromium: CVE-2023-4368 Insufficient policy enforcement in Extensions API Chromium: CVE-2023-4357 Insufficient validation of untrusted input in XML Chromium: CVE-2023-4356 Use after free in Audio Chromium: CVE-2023-4355 Out of bounds memory access in V8 Chromium: CVE-2023-4354 Heap buffer overflow in Skia Chromium: CVE-2023-4353 Heap buffer overflow in ANGLE CVE-2023-37369

Google Security Advisories

Chrome Releases: Stable Channel Update for Desktop

Amazon AWS Security Advisories

Kubernetes Security Issues (CVE-2023-3676, CVE-2023-3893, CVE-2023-3893)

Github Security Advisories

[GHSA-jcf2-mxr2-gmqp] OpenFGA Authorization Bypass [GHSA-j8g2-6fc7-q8f8] Pyramid static view path traversal up one directory [GHSA-826j-8wp2-4x6q] Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User [GHSA-256m-j5qw-38f4] Netmaker IDOR Allows User to Update Other User's Password [GHSA-8x8h-hcq8-jwwx] Netmaker has Hardcoded DNS Secret Key [GHSA-gcq9-qqwx-rgj3] libp2p nodes vulnerable to OOM attack [GHSA-37xq-q42p-rv3p] ntpd has Dependency on Vulnerable Third-Party Component [GHSA-3x59-vrmc-5mx6] @webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content [GHSA-wrrj-h57r-vx9p] Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports [GHSA-q4pp-j36h-3gqg] Minimal `basti` IAM Policy Allows Shell Access [GHSA-v86x-5fm3-5p7j] Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint [GHSA-8xhr-x3v8-rghj] XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution [GHSA-4f8m-7h83-9f6m] XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action [GHSA-c8xw-vjgf-94hr] Argo CD web terminal session doesn't expire [GHSA-7ch3-7pp7-7cpq] Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users [GHSA-8697-479h-5mfp] Weaviate denial of service vulnerability [GHSA-j55r-787p-m549] Shescape on Windows escaping may be bypassed in threaded context [GHSA-599v-h3q5-g6r9] Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields [GHSA-p8gp-899c-jvq9] Wallabag user can reset data unintentionally [GHSA-gjvc-55fw-v6vq] Wallabag user can delete own API client unintentionally [GHSA-vx8m-6fhw-pccw] @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError [GHSA-5mf8-v43w-mfxp] XWiki Platform privilege escalation (PR) from account through AWM content fields [GHSA-h8cm-3v5f-rgp6] XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer [GHSA-44wr-rmwq-3phw] Craft CMS vulnerable to Remote Code Execution via validatePath bypass

CISA Known Exploted Vulnerabilities

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability CVE-2023-26359 Ivanti Sentry Authentication Bypass Vulnerability CVE-2023-38035 Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability CVE-2023-27532 RARLAB WinRAR Code Execution Vulnerability CVE-2023-38831 Ignite Realtime Openfire Path Traversal Vulnerability CVE-2023-32315

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.