4440 matches found
vm2 vulnerable to Inspect Manipulation
In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. Impact A threat actor can edit options for console.log. Patches This vulnerability was patched in the release of version 3.9.18 of vm2. Workarounds After...
CentOS 8 : python27:2.7 (CESA-2023:2860)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:2860 advisory. - An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decode...
RHEL 8 : git (RHSA-2023:2859)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2859 advisory. Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a...
vm2 Sandbox Escape vulnerability
A sandbox escape vulnerability exists in vm2 for versions up to 3.9.17. It abuses an unexpected creation of a host object based on the specification of Proxy. Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. Patches Thi...
Command injection
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This...
CVE-2023-32313 Inspect method manipulation in vm2
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This...
Inadequate checks for comptroller in PoolRegistry#addMarket allows malicious comptrollers to be added
Lines of code Vulnerability details Impact Malicious comptrollers will be available in the protocol Proof of Concept The addMarket function only checks that the input.comptroller is not the 0 address, but does not check if the comptroller was actually created by the PoolRegistry contract. A...
RHEL 9 : git (RHSA-2023:2319)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2319 advisory. Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a...
CVE-2023-25006
A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution...
CVE-2023-20879
VMware Aria Operations contains a Local privilege escalation vulnerability. A malicious actor with administrative privileges in the Aria Operations application can gain root access to the underlying operating system...
CVE-2023-25006
A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution...
CVE-2023-25007
A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution...
CVE-2023-25009
A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution...
CVE-2023-25008
A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result in code execution...
Remote code execution
A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code execution...
Out-of-bounds
A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result in code execution...
Design/Logic Flaw
A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in code execution...
Out-of-bounds
A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result in code execution...
XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks
Cybersecurity researchers have discovered an ongoing phishing campaign that makes use of a unique attack chain to deliver the XWorm malware on targeted systems. Securonix, which is tracking the activity cluster under the name MEME4CHAN, said some of the attacks have primarily targeted manufacturi...