National Cyber Awareness System

Mozilla Releases Security Updates for Firefox and Thunderbird Adobe Releases Security Updates for ColdFusion CISA, FBI, MS-ISAC, and ASD’s ACSC Release Advisory on LockBit Affiliates Exploiting Citrix Bleed CISA Adds One Known Exploited Vulnerability to Catalog CISA Releases Five Industrial Control Systems Advisories

Mozilla Security Advisories

Security Vulnerabilities fixed in Thunderbird 115.5.0 mfsa2023-52 Security Vulnerabilities fixed in Firefox for iOS 120 mfsa2023-51 Security Vulnerabilities fixed in Firefox ESR 115.5 mfsa2023-50 Security Vulnerabilities fixed in Firefox 120 mfsa2023-49

Ubuntu Security Notices

Python vulnerabilities: USN-6513-1 LibTIFF vulnerabilities: USN-6512-1 OpenZFS vulnerability: USN-6511-1 Apache HTTP Server vulnerability: USN-6510-1 Firefox vulnerabilities: USN-6509-1 poppler vulnerabilities: USN-6508-1 GlusterFS vulnerability: USN-6507-1 Apache HTTP Server vulnerabilities: USN-6506-1 nghttp2 vulnerability: USN-6505-1 tracker-miners vulnerability: USN-6504-1 Linux kernel vulnerabilities: USN-6503-1 / USN-6502-1 / USN-6495-1 / USN-6496-1 / USN-6494-1 RabbitMQ vulnerability: USN-6501-1 Squid vulnerabilities: USN-6500-1 GnuTLS vulnerability: USN-6499-1 FRR vulnerabilities: USN-6498-1 Mosquitto vulnerabilities: USN-6492-1 Linux kernel (OEM) vulnerabilities: USN-6497-1 hibagent update: USN-6493-2 / USN-6493-1 Node.js vulnerabilities: USN-6491-1 Tang vulnerability: USN-6489-1 WebKitGTK vulnerabilities: USN-6490-1 strongSwan vulnerability: USN-6488-1 Avahi vulnerabilities: USN-6487-1 iniParser vulnerability: USN-6486-1

Red Hat Security Advisory

Important: Red Hat Single Sign-On 7.6.6 security update: RHSA-2023:7488 Important: Red Hat Single Sign-On 7.6.6 for OpenShift image enhancement and security update: RHSA-2023:7486 Moderate: samba security update: RHSA-2023:7467 / RHSA-2023:7464 / RHSA-2023:7408 Important: squid security update: RHSA-2023:7465 Important: Red Hat OpenStack Platform 17.1.1 (python-gevent) security update: RHSA-2023:7438 Important: tigervnc security update: RHSA-2023:7436 / RHSA-2023:7428 / RHSA-2023:7373 Important: kernel security and bug fix update: RHSA-2023:7434 / RHSA-2023:7382 Important: kernel-rt security update: RHSA-2023:7431 / RHSA-2023:7424 / RHSA-2023:7389 / RHSA-2023:7379 Important: kernel security update: RHSA-2023:7423 Important: kpatch-patch security update: RHSA-2023:7419 / RHSA-2023:7418 / RHSA-2023:7417 / RHSA-2023:7411 / RHSA-2023:7410 Important: OpenShift Container Platform 4.12.44 bug fix and security update: RHSA-2023:6894 Important: OpenShift Container Platform 4.12.44 security and extras update: RHSA-2023:6893 Important: OpenShift Container Platform 4.13.23 packages and security update: RHSA-2023:7325 Moderate: glibc security update: RHSA-2023:7409 Moderate: pixman security update: RHSA-2023:7403 / RHSA-2023:7386 / RHSA-2023:7375 Important: OpenShift Container Platform 4.13.23 bug fix and security update: RHSA-2023:7323 Moderate: fence-agents security update: RHSA-2023:7378 Moderate: libqb security update: RHSA-2023:7376 Moderate: c-ares security update: RHSA-2023:7368 Moderate: ncurses security update: RHSA-2023:7361 Important: Red Hat OpenShift GitOps v1.9.3 security update: RHSA-2023:7345 Important: openshift-gitops-kam security update: RHSA-2023:7344

Github Security Advisories

[GHSA-v4v2-8h88-65qj] Attribute Injection leading to XSS(Cross-Site-Scripting) [GHSA-rqr8-pxh7-cq3g] Ethereum ABI decoder DoS when parsing ZST [GHSA-fpvw-6m5v-hqfp] Capsule Proxy Authentication bypass using an empty token [GHSA-v427-c49j-8w6x] Cleartext Storage of Sensitive Information in HMAC SHA256 Authentication [GHSA-j72f-h752-mx4w] Insertion of Sensitive Information into Log [GHSA-cf9f-wmhp-v4pr] Cross-site Scripting potential in custom links, job buttons, and computed fields [GHSA-8jjh-j3c2-cjcv] Cross-site Scripting via uploaded assets [GHSA-qf3c-rw9f-jh7v] Clear Text Credentials Exposed via Onboarding Task [GHSA-h73m-pcfw-25h2] Download to arbitrary folder can lead to RCE [GHSA-vccg-f4gp-45x9] Eval Injection in fastbots [GHSA-m2mj-pr4f-h9jp] TorchServe ZipSlip [GHSA-v64w-49xw-qq89] Possible user mocking that bypasses basic authentication [GHSA-6h67-934r-82g7] Bypass of field access control in strapi-plugin-protected-populate [GHSA-4f4c-rhjv-4wgv] Cross-Site Request Forgery with QueryOnXWiki allows arbitrary database queries [GHSA-8jpr-ff92-hpf9] Run Shell Command allows Cross-Site Request Forgery [GHSA-7fqr-97j7-jgf4] Whole content of all documents of all wikis exposed to anybody with view right on Solr suggest service [GHSA-7rfg-6273-f5wp] Cookies are sent to external images in rendered diff (and server side request forgery) [GHSA-c2ff-88x2-x9pg] JWT Algorithm Confusion

CISA Known Exploted Vulnerabilities

GNU C Library Buffer Overflow Vulnerability CVE-2023-4911

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.