CVE-2023-41105

An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath, the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python...

MAL-2023-1539 Malicious code in angl-archtslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e5d9cbbc6608e412a429d0d62fb5d10c38aa9be4ceb86df876f1f1aaafeb52ec The OpenSSF Package Analysis project identified 'angl-archtslint' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.

In large metropolitan areas, tourists are often easy to spot because theyre far more inclined than locals to gaze upward at the surrounding skyscrapers. Security experts say this same tourist dynamic is a dead giveaway in virtually all computer intrusions that lead to devastating attacks like dat...

Applying AI to License Plate Surveillance

License plate scanners arent new. Neither is using them for bulk surveillance. Whats new is that AI is being used on the data, identifying "suspicious" vehicle behavior: Typically, Automatic License Plate Recognition ALPR technology is used to search for plates linked to specific crimes. But in...

Butterfly Button 安全漏洞

Butterfly Button is an application by the individual developers of TheButterflySDK who are actively involved in the fight against domestic violence. Butterfly Button suffers from a security vulnerability that stems from the presence of unauthorized behavior that can lead to the disclosure of...

Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default. This allows unauthenticated attackers to trigger builds of...

GHSA-RC33-44QP-VPVQ Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default. This allows unauthenticated attackers to trigger builds of...

Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default. This allows unauthenticated attackers to trigger builds of...

GHSA-QXWC-WCHR-5H29 Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure

Jenkins Gogs Plugin provides a webhook endpoint at /gogs-webhook that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default. This allows unauthenticated attackers to trigger builds of...

GHSA-XVHG-W6QC-M3QQ Yaklang Plugin's Fuzztag Component Allows Unauthorized Local File Reading

Impact The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to the unintended exposure of sensitive data, potential...

Malicious code in flowtorch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6c2c3f2d7423991d07fec2693f59f64eaa2f3a3d0122fbf6f05e19a6d2a40871 The OpenSSF Package Analysis project identified 'flowtorch' @ 9.2.2 npm as malicious. It is considered malicious because: - The package...

Remote code execution

yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion LFI vulnerability. This vulnerability allows attackers to include files from the server's local file system through the web application. When exploited, this can lead to t...

Identity Threat Detection and Response: Rips in Your Identity Fabric

Why SaaS Security Is a Challenge In today's digital landscape, organizations are increasingly relying on Software-as-a-Service SaaS applications to drive their operations. However, this widespread adoption has also opened the doors to new security risks and vulnerabilities. The SaaS security atta...

Tigergraph Code Issues Vulnerabilities

TigerGraph is one of the world's fastest and most scalable graph analytics platforms from the TigerGraph community. Enabling real-time big data graph applications. A security vulnerability exists in Tigergraph Enterprise version 3.7.0. An attacker exploiting this vulnerability could change the...

Numlockが勝手に切り替わる

公開デスクトップ利用中に USB テンキーパッドのオン・オフが勝手に切り替わってしまうことがありました。 ・USB テンキーパッドの機種を変更したところ、事象が発生しなくなりました ・使用アプリケーションや操作内容には依存しません ・USB テンキーパッド部分の操作中、意図せず発生した事象であり、キーボードのその他キー操作では発生しませんでした ・なお、接続元端末における以下のレジストリ設定変更では解消しませんでした。 HKEYLOCALMACHINE\SOFTWARE\Wow6432Node\Citrix\ICA Client\Engine\Lockdown Profiles\All...

PT-2023-21750 · Tigergraph · Tigergraph Enterprise

Name of the Vulnerable Software and Affected Versions: Tigergraph Enterprise version 3.7.0 Description: An issue was discovered in the TigerGraph platform, which allows users to define new User Defined Functions UDFs from C/C++ code. This functionality enables users to upload custom C/C++ code,...

CVE-2023-3261: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful exploitation could cause denial of service or unexpected behavior with respect to all interactions relying on the targeted vulnerable binary...

Design/Logic Flaw

Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnormally...

Design/Logic Flaw

Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2023-39384

CVE-2023-39384 affects Huawei HarmonyOS: a vulnerability in the Input Method module where authorization checks are incomplete, enabling an attacker to exploit and cause features to perform abnormally. Root cause: insufficient privilege checks in the Input Method module. Impact per sources is abno...