R Programming Language implementations are vulnerable to arbitrary code execution during deserialization of .rds and .rdx files

Overview A vulnerability in the R language that allows for arbitrary code to be executed directly after the deserialization of untrusted data has been discovered. This vulnerability can be exploited through RDS R Data Serialization format files and .rdx files. An attacker can create malicious RDS...

CVE-2024-27322: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS R Data Serialization formatted file or R package to run arbitrary code on an end user’s system when interacted...

Mitsubishi Electric MELSEC iQ-R series Information Disclosure Vulnerability

The Mitsubishi Electric MELSEC iQ-R series is a programmable logic controller from Mitsubishi Electric Japan. The Mitsubishi Electric MELSEC iQ-R series suffers from an information disclosure vulnerability that can be exploited by an authenticated, remote attacker to log in to the product and...

r-broker.ru Cross Site Scripting vulnerability OBB-3918433

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the microprogrammed software of the MELSEC iQ-R Series Safety CPU and Series SIL2 Process CPU modules, related to incorrect privilege assignment, allows an intruder to gain unauthorized access to protected information.

The vulnerability of the microprogramming software for MELSEC iQ-R Series Safety CPUs and Series SIL2 Process CPUs is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information usi...

CVE-2024-30384

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on EX4300 Series allows a locally authenticated attacker with low privileges to cause a Denial-of-Service Dos. If a specific CLI command is issued, a PFE crash wi...

PT-2024-3168 · Juniper Networks · Containerized Routing Protocol Daemon +1

Name of the Vulnerable Software and Affected Versions: Juniper Cloud Native Router JCNR versions prior to 23.4 Containerized Routing Protocol Daemon cRPD versions prior to 23.4R1 Description: The issue is related to the use of hard-coded cryptographic keys in Juniper Cloud Native Router JCNR and...

Declassified NSA Newsletters

Through a 2010 FOIA request yes, it took that long, we have copies of the NSAs KRYPTOS Society Newsletter, "Tales of the Krypt," from 1994 to 2003. There are many interesting things in the 800 pages of newsletter. There are many redactions. And a 1994 review of Applied Cryptography by redacted:...

Varnish Cache 安全漏洞

Varnish Cache is a suite of reverse web caching servers. A security vulnerability exists in Varnish Cache versions prior to 7.3.2 and 7.4.x prior to 7.4.3 and Varnish Enterprise versions prior to 6.0.12r6, which stems from a credit exhaustion that allows HTTP/2 connections to control the flow...

r-nagata.co.jp Cross Site Scripting vulnerability OBB-3877772

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-32282: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in BIOS firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access...

PT-2024-2536

Name of the Vulnerable Software and Affected Versions IntelR Processors affected versions not specified Description A race condition in the BIOS firmware of some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. This issue is related to...

CVE-2023-39368: Protection Mechanism Failure

Protection mechanism failure of bus lock regulator for some IntelR Processors may allow an unauthenticated user to potentially enable denial of service via network access...

CVE-2023-43490: Incorrect Calculation

Incorrect calculation in microcode keying mechanism for some IntelR XeonR D Processors with IntelR SGX may allow a privileged user to potentially enable information disclosure via local access...

CVE-2023-22655: Protection Mechanism Failure

Protection mechanism failure in some 3rd and 4th Generation IntelR XeonR Processors when using IntelR SGX or IntelR TDX may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2023-35191: Uncontrolled Resource Consumption

Uncontrolled resource consumption for some IntelR SPS firmware versions may allow a privileged user to potentially enable denial of service via network access...

CVE-2023-38575: Non-Transparent Sharing of Microarchitectural Resources

Non-transparent sharing of return predictor targets between contexts in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...

CVE-2023-28746: Information Exposure through Microarchitectural State after Transient Execution

Information exposure through microarchitectural state after transient execution from some register files for some IntelR AtomR Processors may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2023-27502: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log file for some IntelR Local Manageability Service software before version 2316.5.1.2 may allow an authenticated user to potentially enable information disclosure via local access...

CVE-2023-28389: Incorrect Default Permissions

Incorrect default permissions in some IntelR CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access...