CVE-2024-22039

CVE-2024-22039 is a critical network-exposed vulnerability in Siemens Cerberus PRO EN/Sinteso EN and Desigo Fire Safety UL/FS products, caused by a stack-based buffer overflow in the network communication library due to unchecked lengths of certain X.509 certificate attributes. Impact: unauthenti...

CVE-2024-26288

An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected...

CVE-2024-26288

CVE-2024-26288 affects PHOENIX CONTACT CHARX SEC devices (CHARX SEC-3000, 3050, 3100, 3150) with versions 1.5.0 and earlier. The vulnerability stems from lack of encryption in MITM-enabled communications, allowing unauthenticated remote attackers to influence data exchange. Impact details in the ...

CVE-2024-26288 PHOENIX CONTACT: Lack of SSL support in CHARX Series

An unauthenticated remote attacker can influence the communication due to the lack of encryption of sensitive data via a MITM. Charging is not affected...

Description of the security update for SharePoint Server Subscription Edition: March 12, 2024 (KB5002564)

None None...

PT-2024-21267 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a possible out of bounds read in the acpm tmu ipc handler function of tmu plugin.c due to a missing bounds check. This could lea...

Malicious code in payatutest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e666f5bddab515c8140e043a16a0947fdd59fcb62ec502650a89ddb5bb92aefb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ifl-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c61d2851c227be102bd3adf8e2fd3b9636e417c5f026c3bcc2b91000551c4f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in global-min-document (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5f31926381530898f76c33bf3a3941e4c37e5866d33fbe1501baa831b6822165 The OpenSSF Package Analysis project identified 'global-min-document' @ 999999999.99.9 npm as malicious. It is considered malicious because: - T...

Malicious code in profectus-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 062a69a64c4e77b2e5cebc7f5d21c239c51139c4d420c9fbf2e616f23ec838a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1063 Malicious code in ycs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8fcf222dfcf6f0f36588b0c11a3e0fd28bac1b86cccc3eac8afb5f9243afffb7 The OpenSSF Package Analysis project identified 'ycs' @ 3.9.9 npm as malicious. It is considered malicious because: - The package communicates...

Malicious code in unity-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d000b4d34f837a9755c05f72318c44ba0f8cf265e46224607cedae43aea73ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1060 Malicious code in unity-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d000b4d34f837a9755c05f72318c44ba0f8cf265e46224607cedae43aea73ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1059 Malicious code in booto3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 517345ec1e168770a23a0845f40ee366e2909fd1175efbb4e2292561345b5665 The OpenSSF Package Analysis project identified 'booto3' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package communicat...

MAL-2024-1077 Malicious code in @spectrocoin/sc-currencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e25c79935b85d9e21d6f39b9f9d5b8d7472c19cd2e49dd4239a6f7298e96502f The OpenSSF Package Analysis project identified '@spectrocoin/sc-currencies' @ 9.9.99 npm as malicious. It is considered malicious because: - Th...

OMRON NJ/NX series vulnerable to path traversal

Overview Machine Automation Controller NJ/NX series provided by OMRON Corporation contain a path traversal vulnerability CWE-22, CVE-2024-27121. OMRON Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact An arbitrary file in the affected product...

CVE-2024-2267

A vulnerability was found in keerti1924 Online-Book-Store-Website 1.0 and classified as problematic. This issue affects some unknown processing of the file /shop.php. The manipulation of the argument productprice leads to business logic errors. The attack may be initiated remotely. The exploit ha...

Sceiner firmware locks and associated devices are vulnerable to encryption downgrade and arbitrary file upload attacks

Overview Sciener is a company that develops software and hardware for electronic locks that are marketed under many different brands. Their hardware works in tandem with an app, called the TTLock app, which is also produced by Sciener. The TTLock app utilizes Bluetooth connections to connect to...

Malicious code in c3-pricecaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b03dfb89422ee188083a005d46e87873b3548d2f360a07d2380736049483de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-27935 Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets o...