CVE-2024-7305 DWF Vulnerability in Autodesk Desktop Software

A maliciously crafted DWF file, when parsed in AdDwfPdk.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...

National Public Data Published Its Own Passwords

New details are emerging about a breach at National Public Data NPD, a consumer data broker that recently spilled hundreds of millions of Americans Social Security Numbers, addresses, and phone numbers online. KrebsOnSecurity has learned that another NPD data broker which shares access to the sam...

Hacked GPS tracker reveals location data of customers

Stalkerware researcher maia arson crimew strikes again. Big time. We know maia as a researcher that loves to go after stalkerware peddlers, which Malwarebytes—as one of the founding members of the Coalition Against Stalkerware—loves to see. This time the target company, Tracki, is one selling GPS...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google USA. Google Pixel has a security vulnerability that stems from improper locking and possible post-release reuse, leading to escalation of local privileges...

DEBIAN-CVE-2024-6221

A vulnerability in corydolphin/flask-cors version 4.0.1 allows the Access-Control-Allow-Private-Network CORS header to be set to true by default. This behavior can expose private network resources to unauthorized external access, leading to significant security risks such as data breaches,...

CVE-2024-7886

A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The real...

CVE-2024-7886

The CVE-2024-7886 entry concerns Scooter Software Beyond Compare versions up to 3.3.5.15075, where the library 7zxa.dll is implicated in an uncontrolled search path issue. The vulnerability requires local access for exploitation, with the root cause described as an unknown functionality within 7z...

CVE-2024-7886 Scooter Software Beyond Compare 7zxa.dll uncontrolled search path

A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The real...

The Slow-Burn Nightmare of the National Public Data Breach

Social Security numbers, physical addresses, and more—all available online. After months of confusion, leaked information from a background-check firm underscores the long-term risks of data breaches...

Attackers Exploit Public .env Files to Breach Cloud Accounts in Extortion Campaign

A large-scale extortion campaign has compromised various organizations by taking advantage of publicly accessible environment variable files .env that contain credentials associated with cloud and social media applications. "Multiple security missteps were present in the course of this campaign,...

Lenovo printers 安全漏洞

Lenovo printers is a printer from the Chinese company Lenovo Lenovo. A security vulnerability exists in Lenovo printers that stems from the presence of a denial of service vulnerability, which could allow an unauthenticated attacker on a shared network to compromise the printer's functionality...

NationalPublicData.com Hack Exposes a Nation’s Data

A great many readers this month reported receiving alerts that their Social Security Number, name, address and other personal information were exposed in a breach at a little-known but aptly-named consumer data broker called NationalPublicData.com. This post examines what we know about a breach...

CVE-2024-42472

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

CVE-2024-42472 Flatpak may allow access to files outside sandbox for certain apps

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

CVE-2024-42472 Flatpak may allow access to files outside sandbox for certain apps

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

The vulnerability of the MoTw mechanism in Microsoft Windows operating systems allows a hacker to bypass the SmartScreen user interface.

The vulnerability of the MoTe-Web mechanism in Microsoft Windows operating systems is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass the SmartScreen user interface remotely, provided that the user opens a specially crafted file...

Devika 安全漏洞

Devika is an advanced AI software engineer open-sourced by stition. It can understand advanced human instructions, break them down into steps, study the relevant information, and write code to achieve a given goal. Devika suffers from a security vulnerability that stems from the presence of a...

The vulnerability of D-Link router microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system command. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of D-Link DIR-1960-US, DIR-2640-US, DIR-2660-US, DIR-3040-US, DIR-3060-US, DIR-867-US, DIR-878, DIR-882-US, DIR-882/RE, DIR-882-CA, and DIR-882-US/RE routers exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability can allow a malicious...

K000140693: Apache HTTP server vulnerability CVE-2024-39573

Security Advisory Description Potential SSRF in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by modproxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-39573...

FBI Shuts Down Dispossessor Ransomware Group's Servers Across U.S., U.K., and Germany

The U.S. Federal Bureau of Investigation FBI on Monday announced the disruption of online infrastructure associated with a nascent ransomware group called Radar/Dispossessor. The effort saw the dismantling of three U.S. servers, three United Kingdom servers, 18 German servers, eight U.S.-based...