CVE-2023-40729

CVE-2023-40729 affects Siemens QMS Automotive: all versions prior to V12.39 are vulnerable due to unencrypted (HTTPS-free) communications, enabling MITM manipulation or theft of confidential data. Connected documents confirm the issue in QMS Automotive and specify the root cause as lack of securi...

CVE-2023-40729

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who managed to gain machine-in-the-middle position could manipulate, or steal confidential information...

Free Download Manager backdoored – a possible supply chain attack on Linux machines

UPDATE 13.09.2023. Free Download Manager team issued an official statement regarding this incident. Over the last few years, Linux machines have become a more and more prominent target for all sorts of threat actors. According to our telemetry, 260,000 unique Linux samples appeared in the first...

Siemens QMS Automotive 安全漏洞

Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. A security vulnerability exists in Siemens QMS Automotive version V12.39, which stems from a lack of security controls in the affected application to prevent unencrypted communication without...

PT-2023-27752 · Macvim · Macvim

Name of the Vulnerable Software and Affected Versions: Macvim versions prior to 178 Description: The issue is related to an insecure interprocess communication IPC mechanism in Macvim, a text editor for MacOS. This mechanism could lead to a privilege escalation. Distributed objects, a concept...

PT-2023-5185 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: A vulnerability has been identified in the affected application, which lacks security control to prevent unencrypted communication without HTTPS. This could allow an attacker who gains a...

CVE-2023-35671

In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no addition...

MAL-2023-8065 Malicious code in @get-bridge/tapestry-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bc1d41f48feb6046e7a27f7a15290bb4b1b479f102ed0d6ebd6cdc4bc89d8210 The OpenSSF Package Analysis project identified '@get-bridge/tapestry-sdk' @ 99.99.991 npm as malicious. It is considered malicious because: - T...

Malicious code in @get-bridge/bridge-string-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e69ac01e87147a835e5ab4045ff640d7fa9d2eb636aeb12eef6e1fc1577d021f The OpenSSF Package Analysis project identified '@get-bridge/bridge-string-utils' @ 99.99.99 npm as malicious. It is considered malicious becaus...

USN-6339-3 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-raspi vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service system crash. CVE-2022-48425...

DEBIAN-CVE-2023-4574

When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable...

Malicious code in npm-random-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e52ede67a495176f0c0e0501c905f88aca3d270ae33cea9490c1f1dfe9bcef8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mozilla: Memory corruption in IPC FilePickerShownCallback

The Mozilla Foundation Security Advisory describes this flaw as: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could...

Mozilla: Memory corruption in IPC ColorPickerShownCallback

The Mozilla Foundation Security Advisory describes this flaw as: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could...

Users can lost their USDY tokens in the Source Chain if something fails during the crosschain communication because there is not a validation mechanism to confirm that tokens were minted in the Destination Chain

Lines of code Vulnerability details Impact Users can lost their USDY tokens that were burnt in the Source Chain when bridging to another chain. Proof of Concept The bridging implementation solely relies and assumes that all messages sent to the Axelar Network will be validated and won't have any...

USN-6350-1 linux-aws, linux-aws-5.15, linux-ibm-5.15, linux-oracle, linux-oracle-5.15 vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service system crash. CVE-2022-48425...

Ubuntu 20.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-6347-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6347-1 advisory. William Zhao discovered that the Traffic Control TC subsystem in the Linux kernel did not properly handle network packet retransmission in certain...

Malicious code in @grabdefence/trust-feature-bank-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfec11e2fa47a7b42d7e359d1dc08305ca989ded929ed38507f02f3d74df3a93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WEM: after upgrade , Agent does not register with the cloud infrastructure server

After running the configuration utility on the agent to migrate to the cloud WEM broker server it looses the connectivity. Checking theCitrix WEM Agent Host service debug logs show the below error Event - BaseBrokerClient1.GetConnectorAuthContext : Successfully acquired connector authentication...

Mozilla: Memory corruption in IPC CanvasTranslator

The Mozilla Foundation Security Advisory describes this flaw as: When receiving rendering data over IPC mStream could have been destroyed when initialized, which could have led to a use-after-free causing a potentially exploitable crash...