PyTorch < 2.2.2 RCE

The remote host contains a torchserve version that is prior to 2.2.2. It is, therefore, affected by a remote code execution vulnerability. A vulnerability in the PyTorch's torch.distributed.rpc framework, specifically in versions prior to 2.2.2, allows for remote code execution RCE. The framework...

Multiple Threat Actors Deploying Open-Source Rafel RAT to Target Android Devices

Multiple threat actors, including cyber espionage groups, are employing an open-source Android remote administration tool called Rafel RAT to meet their operational objectives by masquerading it as Instagram, WhatsApp, and various e-commerce and antivirus apps. "It provides malicious actors with ...

DEBIAN-CVE-2024-38381

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in ncirxwork syzbot reported the following uninit-value access issue 1 ncirxwork parses received packet from ndev-rxq. It should be validated header size, payload size and total packet size before...

UBUNTU-CVE-2024-38381

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in ncirxwork syzbot reported the following uninit-value access issue 1 ncirxwork parses received packet from ndev-rxq. It should be validated header size, payload size and total packet size before...

CVE-2024-3036 Communication DoS vulnerability

Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending specifically crafted messages. This issue affects 800xA Base: from 6.0.0 through 6.1.1-2...

CVE-2024-3036 Communication DoS vulnerability

Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending specifically crafted messages. This issue affects 800xA Base: from 6.0.0 through 6.1.1-2...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel, which originates from the presence of uninitialized variables in the nfc:nci module ncirxwork...

Streamline NX Client < 3.4.3.2 / 3.5.x < 3.5.1.202 / 3.6.x < 3.6.2.2 RCE (2024-000004)

The version of Streamline NX Client installed on the remote host is prior to 3.231.0, 3.4.3.2, 3.5.1.202 or 3.6.2.2. It is, therefore, affected by a vulnerability as referenced in the 2024-000004 advisory. - Improper restriction of communication channel to intended endpoints issue exists in Ricoh...

MAL-2024-1649 Malicious code in melichat-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d7d152708054848a62109924487b7dcacac50e054b19a8682b3b0b26b279e6b The OpenSSF Package Analysis project identified 'melichat-component-library' @ 1.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-1645 Malicious code in comet-chat-react-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9a6f38c4d9dd2413e237c8d146d5fcf11d04f613910b552a32a52b3e4cf199f6 The OpenSSF Package Analysis project identified 'comet-chat-react-ui-kit' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

CVE-2024-38355 Unhandled 'error' event in socket.io

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in...

CVE-2024-38355 Unhandled 'error' event in socket.io

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in...

CVE-2024-38355 Unhandled 'error' event in socket.io

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit 15af22fc22 which has been included in...

CVE-2024-38355

Socket.IO vulnerability CVE-2024-38355 involves an unhandled 'error' event that can trigger an uncaught exception on the Socket.IO server, potentially killing a Node.js process and enabling a denial-of-service condition. Official details state a fix is included in [email protected] (May 2023) and b...

DEBIAN-CVE-2021-47612

In the Linux kernel, the following vulnerability has been resolved: nfc: fix segfault in nfcgenldumpdevicesdone When kmalloc in nfcgenldumpdevices fails then nfcgenldumpdevicesdone segfaults as below KASAN: null-ptr-deref in range 0x0000000000000008-0x000000000000000f CPU: 0 PID: 25 Comm:...

MAL-2024-1641 Malicious code in @wdpx/themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 027f3f6ecca8b2d2bd6a4d8c6b358eb1ea8ea1f094cfe3d2606095b6b17d822f The OpenSSF Package Analysis project identified '@wdpx/themes' @ 3.0.2 npm as malicious. It is considered malicious because: - The package...

CVE-2024-36252

Improper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is installed...

CVE-2024-36252

Improper restriction of communication channel to intended endpoints issue exists in Ricoh Streamline NX PC Client ver.3.6.x and earlier. If this vulnerability is exploited, arbitrary code may be executed on the PC where the product is installed...

CVE-2024-36252

CVE-2024-36252 affects Ricoh Streamline NX PC Client versions 3.6.x and earlier. The root cause is an improper restriction of the communication channel to intended endpoints (CWE-923). Successful exploitation could lead to arbitrary code execution on the host PC. Several connected sources corrobo...

Malicious code in mvp-website-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89574af4bb00d4c540ffc8651f5ef4bcc0f72af2368ee6e32346807e91d2e8a0 The OpenSSF Package Analysis project identified 'mvp-website-html' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...