CVE-2024-2162 Authenticated Remote Code Execution in Kiloview NDI N series products
An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges. This issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227...
8.8CVSS
9.2AI Score
0.0004EPSS
CVE-2024-2161 Use of Hard-coded Credentials in Kiloview NDI N series products API middleware
Use of Hard-coded Credentials in Kiloview NDI allows un-authenticated users to bypass authenticationThis issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227...
9.8CVSS
9.7AI Score
0.0004EPSS
The Not-so-True People-Search Network from China
It's not unusual for the data brokers behind people-search websites to use pseudonyms in their day-to-day lives (you would, too). Some of these personal data purveyors even try to reinvent their online identities in a bid to hide their conflicts of interest. But it's not every day you run across a....
6.4AI Score
EulerOS Virtualization 2.11.0 : kernel (EulerOS-SA-2024-1443)
According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Information exposure through microarchitectural state after transient execution in certain vector execution units for some...
8.8CVSS
8.8AI Score
0.024EPSS
7.8CVSS
7.2AI Score
0.003EPSS
The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key....
7AI Score
0.0004EPSS
EulerOS Virtualization 2.11.0 : curl (EulerOS-SA-2024-1439)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name...
9.8CVSS
7.7AI Score
0.003EPSS
Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2024-1417)
The remote host is missing an update for the Huawei...
7.8CVSS
6.3AI Score
0.002EPSS
EulerOS Virtualization 2.11.1 : curl (EulerOS-SA-2024-1411)
According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name...
9.8CVSS
7.2AI Score
0.003EPSS
EulerOS Virtualization 2.11.1 : kernel (EulerOS-SA-2024-1415)
According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Information exposure through microarchitectural state after transient execution in certain vector execution units for some...
8.8CVSS
8.8AI Score
0.024EPSS
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2024-1439)
The remote host is missing an update for the Huawei...
9.8CVSS
8AI Score
0.003EPSS
K000138966 : Intel Xeon CPU vulnerability CVE-2023-23908
Security Advisory Description Improper access control in some 3rd Generation Intel(R) Xeon(R) Scalable processors may allow a privileged user to potentially enable information disclosure via local access. (CVE-2023-23908) Impact This vulnerability may allow a privileged user to enable information.....
4.4CVSS
6AI Score
0.0004EPSS
The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key....
6.9AI Score
0.0004EPSS
EulerOS Virtualization 2.11.1 : openssl (EulerOS-SA-2024-1417)
According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal...
7.8CVSS
8AI Score
0.002EPSS
Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2024-1411)
The remote host is missing an update for the Huawei...
9.8CVSS
8AI Score
0.003EPSS
Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2024-1445)
The remote host is missing an update for the Huawei...
7.8CVSS
6.3AI Score
0.002EPSS
EulerOS Virtualization 2.11.0 : openssl (EulerOS-SA-2024-1445)
According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal...
7.8CVSS
8AI Score
0.002EPSS
linux-gcp, linux-gcp-4.15 vulnerabilities
Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service (bluetooth communication). (CVE-2023-2002) It was discovered that the NVIDIA...
7.8CVSS
8AI Score
0.003EPSS
[updated] Apex Legends Global Series plagued by hackers
The North American finals of online shooter game Apex Legends has been postponed after games were disrupted by hacking incidents. Apex Legends, published by EA, is currently in an important stage of its Global Series, the regional finals mode. This is a big deal for the top players since there is.....
7.6AI Score
RCE vulnerability with .rdoc_options in RDoc
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be.....
8.3AI Score
EPSS
Buffer overread vulnerability in StringIO
An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value. This vulnerability is not affected...
7AI Score
EPSS
Security Bulletin: Vulnerability in Apache Commons affect Cloud Pak System [CVE-2023-24998]
Summary Vulnerability in Apache Commons affect Cloud Pak System. Vulnerability Details ** CVEID: CVE-2023-24998 DESCRIPTION: **Apache Commons FileUpload and Tomcat are vulnerable to a denial of service, caused by not limit the number of request parts to be processed in the file upload function....
7.5CVSS
7AI Score
0.034EPSS
Releases Ubuntu 20.04 LTS Ubuntu 18.04 ESM Packages linux-aws - Linux kernel for Amazon Web Services (AWS) systems linux-aws-5.4 - Linux kernel for Amazon Web Services (AWS) systems linux-gcp-5.4 - Linux kernel for Google Cloud Platform (GCP) systems linux-raspi - Linux kernel for Raspberry Pi...
7.8CVSS
7.6AI Score
0.002EPSS
Releases Ubuntu 23.10 Ubuntu 22.04 LTS Packages linux - Linux kernel linux-azure - Linux kernel for Microsoft Azure Cloud systems linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems linux-gcp-6.5 - Linux kernel for Google Cloud Platform (GCP) systems linux-hwe-6.5 - Linux hardware...
7.8CVSS
7.7AI Score
0.002EPSS
A vulnerability exists in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. Please see the....
5.8CVSS
7.2AI Score
0.0004EPSS
Linux kernel (GCP) vulnerabilities
Releases Ubuntu 18.04 ESM Ubuntu 16.04 ESM Packages linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems linux-gcp-4.15 - Linux kernel for Google Cloud Platform (GCP) systems Details Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform...
7.8CVSS
8.5AI Score
0.003EPSS
Pro Players Hacked Live On Stream! Apex Legends Tournament Postponed
By Deeba Ahmed Apex Legends Global Series Thrown into Chaos as Hackers Invade Live Finals! This is a post from HackRead.com Read the original post: Pro Players Hacked Live On Stream! Apex Legends Tournament...
7.3AI Score
Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud Management X (HCMX) products. The vulnerability could allow Input data manipulation.This issue affects Service Management Automation X (SMAX)....
6.5CVSS
6.9AI Score
0.0004EPSS
Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud Management X (HCMX) products. The vulnerability could allow Input data manipulation.This issue affects Service Management Automation X (SMAX)....
6.5CVSS
6.5AI Score
0.0004EPSS
Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05,...
6.5CVSS
6.8AI Score
0.0004EPSS
Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05,...
6.5CVSS
6.5AI Score
0.0004EPSS
Misinterpretation of Input vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX), and OpenText™ Hybrid Cloud Management X (HCMX) products. The vulnerability could allow Input data manipulation.This issue affects Service Management Automation X (SMAX)....
6.5CVSS
6.7AI Score
0.0004EPSS
Insufficient Granularity of Access Control vulnerability in OpenText™ Service Management Automation X (SMAX), OpenText™ Asset Management X (AMX) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Service Management Automation X (SMAX) versions 2020.05,...
6.5CVSS
6.7AI Score
0.0004EPSS
Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM License Metric Tool v9.
Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 used by IBM License Metric Tool. These issues were disclosed as part of the IBM Java SDK updates in Jan 2024. Vulnerability Details ** CVEID: CVE-2024-20952 DESCRIPTION: **An unspecified vulnerability in...
7.5CVSS
8AI Score
0.001EPSS
Cross-Site Request Forgery in Apache Wicket
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...
7.2AI Score
0.0004EPSS
Cross-Site Request Forgery in Apache Wicket
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...
7.2AI Score
0.0004EPSS
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...
6.8AI Score
0.0004EPSS
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...
6.6AI Score
0.0004EPSS
CVE-2024-27439 Apache Wicket: Possible bypass of CSRF protection
An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...
6.9AI Score
0.0004EPSS
Hackers Exploiting Popular Document Publishing Sites for Phishing Attacks
Threat actors are leveraging digital document publishing (DDP) sites hosted on platforms like FlipSnack, Issuu, Marq, Publuu, RelayTo, and Simplebooklet for carrying out phishing, credential harvesting, and session token theft, once again underscoring how threat actors are repurposing legitimate...
7.5AI Score
Suspected Russian Data-Wiping 'AcidPour' Malware Targeting Linux x86 Devices
A new variant of a data wiping malware called AcidRain has been detected in the wild that's specifically designed for targeting Linux x86 devices. The malware, dubbed AcidPour, is compiled for Linux x86 devices, SentinelOne's Juan Andres Guerrero-Saade said in a series of posts on X. "The new...
7.3AI Score
E-Root Marketplace Admin Sentenced to 42 Months for Selling 350K Stolen Credentials
A 31-year-old Moldovan national has been sentenced to 42 months in prison in the U.S. for operating an illicit marketplace called E-Root Marketplace that offered for sale hundreds of thousands of compromised credentials, the Department of Justice (DoJ) announced. Sandu Boris Diaconu was charged...
7.1AI Score
Implementations of UDP-based application protocols are vulnerable to network loops
Overview A novel traffic-loop vulnerability has been identified against certain implementations of UDP-based applications protocols. An unauthenticated attacker can use maliciously-crafted packets against a UDP-based vulnerable implementation of application protocols (e.g., DNS, NTP, TFTP) that...
6.5CVSS
7.8AI Score
0.965EPSS
7.8CVSS
8.2AI Score
0.0004EPSS
7.8CVSS
7.2AI Score
0.003EPSS
Fortinet FortiProxy curl and libcurl Multiple Vulnerabilities (FG-IR-23-385)
The version of FortiProxy installed on the remote host is 7.0.x, 7.2.x prior to 7.2.8, or 7.4.x prior to 7.4.2. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-23-385 advisory. This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When...
9.8CVSS
8.2AI Score
0.003EPSS
Fortinet Fortigate curl and libcurl Multiple Vulnerabilities (FG-IR-23-385)
The version of Fortigate installed on the remote host is 7.0.x prior to 7.0.14, 7.2.x prior to 7.2.7, or 7.4.x prior to 7.4.2. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-23-385 advisory. This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy...
9.8CVSS
8.2AI Score
0.003EPSS
According to its self-reported version, Cisco IOS XR is affected by a vulnerability. A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to...
7.4CVSS
7.1AI Score
0.0004EPSS
Stable Channel Update for Desktop
The Chrome team is delighted to announce the promotion of Chrome 123 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 123.0.6312.58 (Linux) 123.0.6312.58/.59( Windows, Mac) contains a number of fixes and improvements -- a list of changes is...
8.8CVSS
6.8AI Score
0.001EPSS
linux, linux-aws, linux-hwe, linux-kvm, linux-oracle vulnerabilities
Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. A physically proximate attacker could use this to cause a denial of service (bluetooth communication). (CVE-2023-2002) It was discovered that the NVIDIA...
7.8CVSS
8AI Score
0.003EPSS