Ant Media Server does not properly authorize non-administrative API calls

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

GHSA-G95V-3PJ6-J433 Ant Media Server does not properly authorize non-administrative API calls

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

CVE-2024-3462

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

CVE-2023-26566

Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface ARI, which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sent to the API...

Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls

Cybersecurity researchers have uncovered an ongoing social engineering campaign that bombards enterprises with spam emails with the goal of obtaining initial access to their environments for follow-on exploitation. "The incident involves a threat actor overwhelming a user's email with junk and...

Ant Media Server 安全漏洞

Ant Media Server is a real-time streaming engine software from Ant Media open source. It provides adaptive ultra-low latency streaming using WebRTC technology with a latency of approximately 0.5 seconds. A security vulnerability exists in Ant Media Server Community Edition prior to version 2.9.0...

CVE-2024-3462 Authorization bypass in Ant Media Server

Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users. All versions up to 2.9.0 tested and possibly newer ones are believed to be...

PT-2024-26036 · Ant Media Server · Ant Media Server Community Edition

Name of the Vulnerable Software and Affected Versions: Ant Media Server Community Edition versions prior to 2.9.0 Description: The issue is related to an improper HTTP header based authorization, allowing the use of non-administrative API calls reserved for authorized users. Recommendations: For...

RHEL 5 : flex (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - flex: Recursive calls in the function markbeginningasnormal resulting in a denial of service CVE-2019-6293 Note tha...

Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators

Co-authored by Rapid7 analysts Tyler McGraw, Thomas Elkins, and Evan McCann Executive Summary Rapid7 has identified an ongoing social engineering campaign that has been targeting multiple managed detection and response MDR customers. The incident involves a threat actor overwhelming a user's emai...

CVE-2023-26566

Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface ARI, which allows remote attackers to reconfigure Asterisk and make external and internal calls via HTTP and WebSocket requests sent to the API...

NETGEAR CAX30 安全漏洞

The NETGEAR CAX30 is a router from NETGEAR. A security vulnerability exists in the NETGEAR CAX30S that originates from a lack of proper validation of user-supplied strings before they are used to execute system calls, which can be exploited by an attacker to execute arbitrary code...

CVE-2024-32807

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal, Manipulating Web Input to File System Calls.This issue affects Sendinblue for WooCommerce: from n/a through 4.0.17...

CVE-2023-41817

An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information...

CVE-2023-41824

Technical details about CVE-2023-41824 are not publicly provided in the connected documents. The materials reiterate an implicit intent vulnerability in Motorola Phone Calls to read calling data but lack specifics on affected versions, root cause, or remediation. Monitor for updates.

CVE-2023-41824

An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the calling phone number and calling data...

CVE-2023-41817

An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information...

CVE-2023-41817

An improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorized information...

CVE-2023-41817

The CVE-2023-41817 case concerns the Motorola Phone Calls application, with an improper export vulnerability that could allow a local attacker to read unauthorized information. The vulnerability is described as a local-exploit, low-severity issue (CVSS v3.1: 2.8, LOW; AV:L/AC:L/PR:L/UI:R/S:U/C:L/...

SUSE CVE-2024-27003

In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree for clksummary Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clksummary through debugfs. Failure to do so would result in a...