Design/Logic Flaw

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged programs are supposed to be able to read uninitialized stack memory ever since 6715df8d5 but, before this patch, these accesses were permitted inconsistently. In particular,...

PT-2024-7722 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The vulnerability is related to the mm/debug vm pgtable component of the Linux kernel, specifically with the function pud advanced tests. It involves incorrect handling of devmap PUD p...

CLSA-2024-1707420277 Fix CVE(s): CVE-2023-46589

SECURITY UPDATE: Incorrect parsing of HTTP trailer headers - debian/patches/CVE-2023-46589.patch: Ensure IOException on request read always triggers error handling - CVE-2023-46589 Internal tests: - debian/patches/0100-stop-testing-if-a-failure-occurs.patch: Stop testing if a failure occurs -...

CLSA-2024-1706697759 Fix CVE(s): CVE-2023-22081

OpenJDK 11.0.21 release, build 9. - CVE-2023-22081 - Release notes: https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-October/026351.html - adjust debian/pathes/exclude-broken-tests.patch...

Top Security Posture Vulnerabilities Revealed

Each New Year introduces a new set of challenges and opportunities for strengthening our cybersecurity posture. It's the nature of the field – the speed at which malicious actors carry out advanced persistent threats brings a constant, evolving battle for cyber resilience. The excitement in...

CLSA-2024-1705081413 Fix CVE(s): CVE-2023-46589

SECURITY UPDATE: Request smuggling - debian/patches/CVE-2023-46589-pre1.patch: Correct a regression in the error page handling that prevented error pages from issuing redirects or taking other action that required the response status code to be changed - debian/patches/CVE-2023-46589-pre2.patch:...

PT-2024-40976 · Microsoft · Ms Windows

Name of the Vulnerable Software and Affected Versions: hawk2 versions prior to 2.6.4+git.1702030539.5fb7d91b Description: The issue concerns the hawk2 software, where several problems have been fixed, including the setting of the HttpOnly secure flag by default and the protection against CSRF in...

nss security update

3.90.0-4 - Fix expired certs in tests - Fix CVE-2023-5388...

Amazon Linux 2 : perl-HTTP-Daemon (ALAS-2024-2405)

The version of perl-HTTP-Daemon installed on the remote host is prior to 6.01-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2405 advisory. HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which cou...

Malware in create-codecpetjs-bdd-tests

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in create-codecpetjs-bdd-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01558db89dd1a8c91f89f5484278ccabfae35f95f9d6500a80a42d59a704c4b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8712 Malicious code in create-codecpetjs-bdd-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01558db89dd1a8c91f89f5484278ccabfae35f95f9d6500a80a42d59a704c4b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-codecpetjs-bdd-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis da2ef24d0c6c635c4cc20335bf5babe60d295ebae2df1d4559bbe24373156bc8 The OpenSSF Package Analysis project identified 'test-codecpetjs-bdd-tests' @ 1.2.3 npm as malicious. It is considered malicious because: - The...

[SECURITY] Fedora 38 Update: perl-Devel-Cover-1.36-11.fc38

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

CLSA-2023-1702573569 Fix of 5 CVEs

SECURITY UPDATE: Update to 5.7.44 to fix security issues - CVE-2023-22053, CVE-2023-22084, CVE-2023-22015, CVE-2023-22026, CVE-2023-22028 debian/patches/offroottests.patch: disable mysqlddaemon and mysqldsafe tests under root due to known issues with these tests...

Reimagining Network Pentesting With Automation

Network penetration testing plays a crucial role in protecting businesses in the ever-evolving world of cybersecurity. Yet, business leaders and IT pros have misconceptions about this process, which impacts their security posture and decision-making. This blog acts as a quick guide on network...

[H-01] Ocean contract and onERC1155Received function is vulnerable to read only reentrancy

Lines of code Vulnerability details Impact The Ocean contract and onERC1155Received function is vulnerable to read only reentrancy when read from another contract. The order of function execution when called externally from the onERC1155Received function in the Ocean contract is as follows. The...

CLSA-2023-1701971229 Fix CVE(s): CVE-2023-40217

SECURITY UPDATE: TLS handshake bypass - debian/patches/CVE-2023-40217.patch: Check for & avoid the ssl pre-close flaw. Update SSL tests - CVE-2023-40217...

[SECURITY] Fedora 39 Update: perl-Devel-Cover-1.40-5.fc39

This module provides code coverage metrics for Perl. Code coverage metrics describe how thoroughly tests exercise code. By using Devel::Cover you can discover areas of code not exercised by your tests and determine which tests to create to increase coverage. Code coverage can be considered as an...

Malicious code in astar-e2e-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9c7d3b2f90649e2315bacb152ef9917066857fd46b3240dca8dfa09ae075df60 The OpenSSF Package Analysis project identified 'astar-e2e-tests' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...