Summary IBM HTTP Server (IHS) is shipped as a component of IBM DevOps Code ClearCase. Information about a security vulnerability affecting IHS has been published in a security bulletin. [CVE-2023-52425] Vulnerability Details Refer to the security bulletin(s) listed in the Remediation/Fixes section....
7.5CVSS
6.9AI Score
0.001EPSS
CVE-2024-24554 Bludit - Insecure Token Generation
Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit...
6.7AI Score
0.0004EPSS
CVE-2024-24554 Bludit - Insecure Token Generation
Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit...
0.0004EPSS
CVE-2024-24553 Bludit uses SHA1 as Password Hashing Algorithm
Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure...
7AI Score
0.0004EPSS
CVE-2024-24553 Bludit uses SHA1 as Password Hashing Algorithm
Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-cryptographically secure...
0.0004EPSS
A week in security (June 17 – June 23)
Last week on Malwarebytes Labs: Microsoft Recall delayed after privacy and security concerns (Almost) everything you always wanted to know about cybersecurity, but were too afraid to ask, with Tjitske de Vries: Lock and Code S05E13 43% of couples experience pressure to share logins and locations,.....
7.6AI Score
CVE-2024-24550 Bludit - Remote Code Execution (RCE) through File API
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabling malicious...
0.0004EPSS
CVE-2024-24550 Bludit - Remote Code Execution (RCE) through File API
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabling malicious...
8AI Score
0.0004EPSS
CVE-2024-4460 DoS Vulnerability in zenml-io/zenml
A denial of service (DoS) vulnerability exists in zenml-io/zenml version 0.56.3 due to improper handling of line feed (\n) characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a \n character,....
4.3CVSS
0.0004EPSS
opencart/opencart is vulnerable to Arbitrary File Creation. The vulnerability is due to insufficient validation in the database restoration functionality, allowing an attacker with admin privileges to inject PHP code and create a backup file with an arbitrary filename and extension within...
7.2CVSS
7AI Score
0.0005EPSS
Multiple Threat Actors Deploying Open-Source Rafel RAT to Target Android Devices
Multiple threat actors, including cyber espionage groups, are employing an open-source Android remote administration tool called Rafel RAT to meet their operational objectives by masquerading it as Instagram, WhatsApp, and various e-commerce and antivirus apps. "It provides malicious actors with a....
7.5AI Score
moodle/moodle is vulnerable to Cross-site Scripting (XSS). The vulnerability is caused due to improper validation of user input in the "Field Name" parameter associated with a new activity, which allows an attacker to perform XSS...
5.8AI Score
0.0004EPSS
A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS....
7.6CVSS
0.0004EPSS
A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS....
7.6CVSS
7.6AI Score
0.0004EPSS
CVE-2024-4499 CSRF Vulnerability in parisneo/lollms XTTS Server
A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS....
7.6CVSS
0.0004EPSS
Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2024-646)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-646 advisory. The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file...
9.8CVSS
8AI Score
0.001EPSS
CentOS 9 : kernel-5.14.0-467.el9
The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-467.el9 build changelog. In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not...
5.5CVSS
7.4AI Score
EPSS
Releases Ubuntu 20.04 LTS Ubuntu 18.04 ESM Ubuntu 16.04 ESM Packages libhibernate3-java - Relational Persistence for Idiomatic Java Details It was discovered that Hibernate incorrectly handled certain inputs with unsanitized literals. If a user or an automated system were tricked into opening...
7.5AI Score
Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the connection_state_machine due to improper length validation for the cookie...
8AI Score
0.0004EPSS
Amazon Linux 2 : webkitgtk4 (ALAS-2024-2577)
The version of webkitgtk4 installed on the remote host is prior to 2.42.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2577 advisory. An injection issue was addressed with improved validation. This issue is fixed in Safari 17.4, macOS Sonoma 14.4,...
6.9AI Score
0.0005EPSS
Amazon Linux 2 : golang (ALAS-2024-2576)
The version of golang installed on the remote host is prior to 1.22.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2576 advisory. The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip...
9.8CVSS
8AI Score
0.001EPSS
Stable Channel Update for Desktop
The Stable channel has been updated to 126.0.6478.126/127 for Windows, Mac and 126.0.6478.126 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept...
7.4AI Score
0.0004EPSS
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4f6c4c07-3179-11ef-9da5-1c697a616631 advisory. GNU Emacs developers report: Emacs 29.4 is an emergency bugfix release intended to fix a security...
7.5AI Score
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Hibernate vulnerability (USN-6845-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6845-1 advisory. It was discovered that Hibernate incorrectly handled certain inputs with unsanitized literals. If a user or an automated system were...
7.4CVSS
7.1AI Score
0.004EPSS
Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrary code via the connection_state_machine due to improper length validation for the cookie...
0.0004EPSS
CVE-2024-37082 - mTLS bypass | Cloud Foundry
Severity CRITICAL Vendor CloudFoundry Foundation Versions Affected Routing Release < 0.299.0 (in combination with HAProxy Release > 10.6.0) Description When deploying Cloud Foundry together with the haproxy-boshrelease and using a non default configuration, it might be possible to craft HTTP....
6.8AI Score
EPSS
[Important] [Security] Virtuozzo ReadyKernel Patch 168.1 for Virtuozzo Hybrid Server 7.5
The cumulative Virtuozzo ReadyKernel patch was updated with security fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.5. Vulnerability id: PSBM-156977 [3.10.0-1160.80.1.vz7.191.4 to 3.10.0-1160.105.1.vz7.214.3] netfilter: A use-after-free vulnerability in...
7.8CVSS
7.1AI Score
0.0004EPSS
9.8CVSS
7.5AI Score
0.001EPSS
Amazon Linux 2 : php (ALASPHP8.1-2024-005)
The version of php installed on the remote host is prior to 8.1.29-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.1-2024-005 advisory. The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default),...
6.5CVSS
7.3AI Score
0.006EPSS
Amazon Linux 2 : kernel (ALASKERNEL-5.4-2024-073)
The version of kernel installed on the remote host is prior to 5.4.149-73.259. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2024-073 advisory. A flaw was found in the Linux kernel. When reusing a socket with an attached dccps_hc_tx_ccid as a ...
7.8CVSS
8.5AI Score
0.003EPSS
Releases Ubuntu 24.04 LTS Ubuntu 23.10 Ubuntu 22.04 LTS Ubuntu 20.04 LTS Ubuntu 18.04 ESM Ubuntu 16.04 ESM Packages cups - Common UNIX Printing System(tm) Details Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the cupsd process fails to validate...
4.4CVSS
7.4AI Score
0.0004EPSS
7.4AI Score
Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2024-037)
The version of ecs-service-connect-agent installed on the remote host is prior to v1.29.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2024-037 advisory. Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling...
8.2CVSS
6.1AI Score
0.001EPSS
Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-647)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-647 advisory. Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into...
8.2CVSS
7.1AI Score
0.001EPSS
6.8CVSS
7.1AI Score
0.0004EPSS
7.4AI Score
Amazon Linux 2 : iperf3 (ALAS-2024-2579)
The version of iperf3 installed on the remote host is prior to 3.1.7-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2579 advisory. It is possible for a malicious or malfunctioning client to send lessthan the expected amount of data to the server. If this...
5.3CVSS
7AI Score
0.0004EPSS
Divi < 4.25.2 - Contributor+ Stored XSS
Description The theme is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses....
6.4CVSS
5.8AI Score
0.0004EPSS
7.1AI Score
0.0004EPSS
Dextaz Ping <= 0.65 - Admin+ RCE
Description The plugin is vulnerable to Remote Code Execution, allowing authenticated attackers, with administrator-level access and above, to execute code on the...
9.1CVSS
7.4AI Score
0.0005EPSS
AMD Client UEFI – Cross-Process Information Leak
AMD has informed HP of a potential security vulnerability identified in some AMD client processors, which might allow information disclosure. AMD released firmware updates to mitigate these vulnerabilities. AMD has released updates to mitigate the potential vulnerability. HP has identified...
5.5CVSS
7AI Score
0.001EPSS
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6844-1 advisory. Rory McNamara discovered that when starting the cupsd server with a Listen configuration item, the...
4.4CVSS
9.6AI Score
0.0004EPSS
Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-062)
The version of kernel installed on the remote host is prior to 5.10.218-206.860. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2024-062 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: flower: protect...
5.5CVSS
6.7AI Score
0.0004EPSS
Amazon Linux 2 : ruby (ALASRUBY3.0-2024-008)
The version of ruby installed on the remote host is prior to 3.0.6-156. It is, therefore, affected by a vulnerability as referenced in the ALAS2RUBY3.0-2024-008 advisory. ruby: RCE vulnerability with .rdoc_options in RDoc (CVE-2024-27281) Tenable has extracted the preceding description block...
6.5AI Score
EPSS
Amazon Linux AMI : R (ALAS-2024-1940)
The version of R installed on the remote host is prior to 3.4.1-1.53. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1940 advisory. Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and...
8.8CVSS
7.5AI Score
0.0004EPSS
Exploit for Incorrect Conversion between Numeric Types in Microsoft
This repository contains a poc for CVE-2023-23388, which is...
8.8CVSS
6.9AI Score
0.0004EPSS
Malicious code in govgen-governance (npm)
-= Per source details. Do not edit below this line.=- Source: ossf-package-analysis (f3c3227cdc330d6755ef62c0fe1cdd3a59c6d22c31cf37af347ef213050680b9) The OpenSSF Package Analysis project identified 'govgen-governance' @ 2.2.1 (npm) as malicious. It is considered malicious because: The package...
7.3AI Score
Malicious code in @amops/fetch (npm)
-= Per source details. Do not edit below this line.=- Source: ossf-package-analysis (d9eb323a3c294832e925d2ed472560ab37507fc32711add225d99db97b08bc74) The OpenSSF Package Analysis project identified '@amops/fetch' @ 1.4.1 (npm) as malicious. It is considered malicious because: The package...
7.1AI Score
VulnNodeApp - A Vulnerable Node.Js Application
A vulnerable application made using node.js, express server and ejs template engine. This application is meant for educational purposes only. Setup Clone this repository git clone https://github.com/4auvar/VulnNodeApp.git Application setup: Install the latest node.js version with npm. Open...
8.4AI Score
Summary Vulnerabilities in IBM® SDK, Java™ Technology Edition may affect IBM Storage Insights which could allow a remote attacker to cause high confidentiality impact and high integrity impact. CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945,...
7.5CVSS
6AI Score
0.001EPSS