PT-2024-2711 · Automationdirect · C-More Ea9 Hmi

Name of the Vulnerable Software and Affected Versions: AutomationDirect C-MORE EA9 HMI affected versions not specified Description: The issue is related to the storage of critical information in plain text, which could allow an attacker to gain unauthorized access to protected information...

Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: parsing large tokens can trigger a denial of service CVE-2023-52425 expat: XML Entity Expansion CVE-2024-28757...

AutomationDirect C-MORE EA9 HMI 安全漏洞

The AutomationDirect C-MORE EA9 HMI is a touchscreen from AutomationDirect, Inc. A security vulnerability exists in the AutomationDirect C-MORE EA9 HMI that originates from a stack overflow caused by copying a buffer of user-controlled size to a buffer of limited size on the stack...

PT-2024-2369 · Automationdirect · Automationdirect C-More Ea9 Hmi

Name of the Vulnerable Software and Affected Versions: AutomationDirect C-MORE EA9 HMI affected versions not specified Description: The issue is related to a function in the AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the...

AutomationDirect C-MORE EA9 HMI 安全漏洞

The AutomationDirect C-MORE EA9 HMI is a touchscreen from AutomationDirect, Inc. A security vulnerability exists in the AutomationDirect C-MORE EA9 HMI that stems from the use of credentials stored in plain text on the device...

GHSA-RF39-3F98-XR7R WiX based installers are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

WiX based installers are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

GHSA-G4V6-69P6-Q3P4 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

GHSA-WQ88-FQ4X-H2PM WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

Fedora: Security Advisory (FEDORA-2024-afb73e6f62)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-10972 · Openeuler · Openeuler Isulad

Name of the Vulnerable Software and Affected Versions: openEuler iSulad version 2.0.18-13 openEuler iSulad versions 2.1.4-1 through 2.1.4-2 Description: The issue is a Time-of-check Time-of-use TOCTOU Race Condition vulnerability in openEuler iSulad on Linux, allowing the leveraging of...

PT-2024-40675 · Git +1 · Libxml2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-use-after-free READ 8 crash occurred, involving the xmlDOMWrapNSNormAcquireNormalizedNs and xmlDOMWrapReconcileNamespaces functions in the api.c...

[SECURITY] Fedora 40 Update: mingw-expat-2.6.1-1.fc40

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

From Observer to Asuka – The Reinvention of Stealer

Summary: A malware-as-a-service MaaS called AsukaStealer, advertised on a Russian-language cybercrime forum by the alias breakcore, has surfaced. Priced at $80 per month, AsukaStealer is written in C++ and features customizable configurations and a user-friendly interface designed for harvesting...

GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws

GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide targeted recommendations in an effort to avoid introducing new security issues. "Powered by GitHub Copilot and CodeQL, code scanning autofi...

Medium: nodejs20

Issue Overview: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files...

Medium: c-ares

Issue Overview: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files...

Medium: nodejs20

Issue Overview: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files...