4435 matches found
The vulnerability of the RubyGems.org repository, related to uncontrolled resource consumption, allows a hacker to cause a service failure.
The vulnerability of the RubyGems.org repository for programming languages involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...
CVE-2024-23321
For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist...
SocGholish Malware Exploits BOINC Project for Covert Cyberattacks
The JavaScript downloader malware known as SocGholish aka FakeUpdates is being used to deliver a remote access trojan called AsyncRAT as well as a legitimate open-source project called BOINC. BOINC, short for Berkeley Open Infrastructure Network Computing Client, is an open-source "volunteer...
CVE-2024-6916: Insecure Storage of Sensitive Information
A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the '--show-inputs-only' flag...
CVE-2023-40223
CVE-2023-40223 affects Philips Vue PACS. The vulnerability is categorized as Improper Privilege Management (CWE-269) in Vue PACS components, with affected product/version details indicating versions prior to 12.2.8.410 are impacted. The technical overview notes an unintended sphere of control due...
PT-2024-12867 · Philips · Philips Vue Pacs
Name of the Vulnerable Software and Affected Versions: Philips Vue PACS affected versions not specified Description: The issue is related to improper assignment, modification, tracking, or checking of actor privileges, resulting in an unintended sphere of control for that actor. Recommendations: ...
CVE-2024-32981 Cross-site Scripting vulnerability with encoded payload in silverstripe/framework
Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end o...
China-linked APT17 Targets Italian Companies with 9002 RAT Malware
A China-linked threat actor called APT17 has been observed targeting Italian companies and government entities using a variant of a known malware referred to as 9002 RAT. The two targeted attacks took place on June 24 and July 2, 2024, Italian cybersecurity company TG Soft said in an analysis...
PT-2024-37892 · Zowe Cli · Zowe Cli
Name of the Vulnerable Software and Affected Versions: Zowe CLI affected versions not specified Description: A local, privileged actor can store previously entered secure credentials in a plaintext file as part of an auto-init operation. Recommendations: At the moment, there is no information abo...
Void Banshee APT Exploits Microsoft MHTML Flaw to Spread Atlantida Stealer
An advanced persistent threat APT group called Void Banshee has been observed exploiting a recently disclosed security flaw in the Microsoft MHTML browser engine as a zero-day to deliver an information stealer called Atlantida. Cybersecurity firm Trend Micro, which observed the activity in mid-Ma...
The vulnerability of the Layer-2 Bridge network driver for Windows operating systems allows a hacker to cause a service failure.
The vulnerability of the Layer-2 Bridge network driver for Windows operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the WebSocket protocol in the Apache HTTP Server web server allows a attacker to induce a service failure.
The vulnerability of the WebSocket protocol in the Apache HTTP Server is related to the assignment of a null pointer. Exploiting this vulnerability could allow a malicious actor to cause a service failure...
CVE-2024-2602
CVE-2024-2602 maps to Schneider Electric EcoStruxure Foxboro SCADA FoxRTU Station, where a Path Traversal flaw in the saved project file handling can enable remote code execution for an authenticated user if the project file has been tampered. Connected sources indicate this affects FoxRTU Statio...
CVE-2024-2602
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could result in remote code execution when an authenticated user executes a saved project file that has been tampered by a malicious actor...
CVE-2024-5680
CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...
CVE-2024-37498
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.33...
CVE-2024-37504
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team FileBird Document Library.This issue affects FileBird Document Library: from n/a through 2.0.6...