MAL-2024-7737 Malicious code in lykooss_poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ba3a00276cdb801eafba21620fd8bb30298090ac3c341a63455934994d7c6bb The OpenSSF Package Analysis project identified 'lykoosspoc' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7738 Malicious code in lykoss_poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 12c9b6b380ba43128b29b663fbcd6e7da2b0311994f94c228fcf282b937c6268 The OpenSSF Package Analysis project identified 'lykosspoc' @ 8.0.0 npm as malicious. It is considered malicious because: - The package...

SUSE CVE-2024-39499

In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in eventdeliver Coverity spotted that eventmsg is controlled by user-space, eventmsg-eventdata.event is passed to eventdeliver and used as an index without sanitization. This...

How to Enable Promiscuous Mode on a Physical Network Card

This article describes how to enable promiscuous mode on a physical Network Interface Card NIC.In a network, promiscuous mode allows a network device to intercept and read each network packet that arrives in its entirety. This mode of operation is sometimes given to a network snoop server that...

How to Enable Special Pool Tagging for a Driver

If the stack of a process is overrun by another process, analysis of the dump is not possible because the crash occurs when the original process writes to the kernel space which is already occupied by the other, misbehaving component. Enabling Special Pool Tagging causes the driver to crash as so...

ROS-20240712-01

Vulnerability in Multiline RFC 2231 component of Exim mail server is related to incorrect analysis of the the multiline RFC 2231 header file name. Exploitation of the vulnerability could allow an attacker, acting remotely, to deliver executable attachments to end-user mailboxes...

Malicious code in test_lykos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5fddd535f0f7f7fc3254ce5f34a55dd81109aa9f9bf9705f19676687dd9aa018 The OpenSSF Package Analysis project identified 'testlykos' @ 200.0.5 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7733 Malicious code in browserlist-config-usaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 02d306368aa4feefa13bbaf28e12d66c8517a1f1e0a4f08e72afd9001d2b2cdb The OpenSSF Package Analysis project identified 'browserlist-config-usaa' @ 9.9.9 npm as malicious. It is considered malicious because: - The...

UBUNTU-CVE-2024-40939

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: Fix tainted pointer delete is case of region creation fail In case of region creation fail in ipcdevlinkcreateregion, previously created regions delete process starts from tainted pointer which actually holds err...

CVE-2024-41003 bpf: Fix reg_set_min_max corruption of fake_reg

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsetminmax corruption of fakereg Juan reported that after doing some changes to buzzer 0 and implementing a new fuzzing strategy guided by coverage, they noticed the following in one of the probes: ... 13: 79 r6 = u64 ...

CVE-2024-41003

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsetminmax corruption of fakereg Juan reported that after doing some changes to buzzer 0 and implementing a new fuzzing strategy guided by coverage, they noticed the following in one of the probes: ... 13: 79 r6 = u64 ...

CVE-2024-40962

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes Shin'ichiro reported that when he's running fstests' test-case btrfs/167 on emulated zoned devices, he's seeing the following NULL pointer dereference in...

CVE-2024-39499 vmci: prevent speculation leaks by sanitizing event in event_deliver()

In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in eventdeliver Coverity spotted that eventmsg is controlled by user-space, eventmsg-eventdata.event is passed to eventdeliver and used as an index without sanitization. This...

CVE-2024-39499 vmci: prevent speculation leaks by sanitizing event in event_deliver()

In the Linux kernel, the following vulnerability has been resolved: vmci: prevent speculation leaks by sanitizing event in eventdeliver Coverity spotted that eventmsg is controlled by user-space, eventmsg-eventdata.event is passed to eventdeliver and used as an index without sanitization. This...

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2024-25026, CVE-2024-22329)

Summary IBM WebSphere Application Server Liberty is vulnerable to denial of service and server-side request forgery. Vulnerability Details CVEID:CVE-2024-25026 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are...

MAL-2024-7729 Malicious code in cx-web-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4311da313c4de72f9e25c5c573ce6a9ebe1bd2cb1c24d5b37af1e4e6d23717ab The OpenSSF Package Analysis project identified 'cx-web-themes' @ 200.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7730 Malicious code in react-native-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1015ecd9733ee94027b1c081070e5866c9bdeb055d78f16a4664531fadba690d The OpenSSF Package Analysis project identified 'react-native-latest' @ 200.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2024-7696 Malicious code in mva10-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fbebcbc3b898726caa3bec8450b38747b8692941527db5fae805fc4d53e4d925 The OpenSSF Package Analysis project identified 'mva10-angular' @ 8.2.0 npm as malicious. It is considered malicious because: - The package...

What’s New in Rapid7 Products & Services: Q2 2024 in Review

This quarter we continued to make investments that provide security professionals with a holistic, actionable view of their entire attack surface. In Q2, we focused on enhancing visualization, prioritization, and integration capabilities across our key products and services. Below we’ve highlight...

MAL-2024-7694 Malicious code in dependencyconfusion7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f7917b183eaefa5d99ccf1984a0d7b5fec312946bc51784c3c850ef10676c89 The OpenSSF Package Analysis project identified 'dependencyconfusion7' @ 2.0.0 npm as malicious. It is considered malicious because: - The packa...