Tencent QQ Local Elevation of Privilege Vulnerability

Tencent QQ is a multi-platform instant messaging software from China's Tencent. A local elevation of privilege vulnerability exists in Tencent QQ. The vulnerability is caused due to QQProtect.exe and QQProtectEngine.dll not validating pointers from inter-process communication, which can lead to a...

Input validation

libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a libspdm Requester stores the Responder's CTExponent into its context without validation. If the Requester sends a request message that...

CVE-2023-32690 Responder can Invoke Undefined Behavior in libspdm Requester

libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a libspdm Requester stores the Responder's CTExponent into its context without validation. If the Requester sends a request message that...

CVE-2023-32690 Responder can Invoke Undefined Behavior in libspdm Requester

libspdm is a sample implementation that follows the DMTF SPDM specifications. Prior to versions 2.3.3 and 3.0, following a successful CAPABILITIES response, a libspdm Requester stores the Responder's CTExponent into its context without validation. If the Requester sends a request message that...

CVE-2023-34312

In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition...

CVE-2023-34312

In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition...

Design/Logic Flaw

In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition...

Tencent QQ 安全漏洞

Tencent QQ is a multi-platform instant messaging software from China's Tencent. A local elevation of privilege vulnerability exists in Tencent QQ. The vulnerability is caused due to QQProtect.exe and QQProtectEngine.dll not validating pointers from inter-process communication, which can lead to a...

CVE-2023-34312

CVE-2023-34312 affects Tencent QQ (versions up to 9.7.8.29039) and TIM (up to 3.4.7.22084). The issue is a write-what-where condition caused by QQProtect.exe and QQProtectEngine.dll not validating pointers from inter-process communication, enabling a local breach with high impact in confidentiali...

CVE-2023-34312

In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition...

CVE-2023-34312

In Tencent QQ through 9.7.8.29039 and TIM through 3.4.7.22084, QQProtect.exe and QQProtectEngine.dll do not validate pointers from inter-process communication, which leads to a write-what-where condition...

Security Bulletin: IBM Maximo Manage in IBM Maximo Application Suite is vulnerable to Insecure Communication (CVE-2023-27861)

Summary IBM Maximo Manage in IBM Maximo Application Suite is vulnerable to Insecure Communication. Vulnerability Details CVEID:CVE-2023-27861 DESCRIPTION: IBM Maximo Application Suite - Manage Component transmits sensitive information in cleartext that could be intercepted by an attacker using ma...

Malicious code in rfs-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 79e642edac55949b293591df1c51b8e8739ca1dd2e99f7e82b235b168287179d The OpenSSF Package Analysis project identified 'rfs-utils' @ 100.100.101 npm as malicious. It is considered malicious because: - The package...

Malicious code in @mddsfmsdflm/itemselector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 88f4e295b9c4b793c8ffbdc4077606b6d5b61c41ab83b85bda2b46680c678174 The OpenSSF Package Analysis project identified '@mddsfmsdflm/itemselector' @ 103.0.9 npm as malicious. It is considered malicious because: - Th...

Malicious code in superagt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d417dfcd3054c03947066c9d5097e7bf561e9b05b055fd5e3caeea7275f4019f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pitito (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c402c7c9c4bff455910dd1b71d4c8d9cb7e47b0daa68d4d68eedf1649965afb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-2002

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...

CVE-2023-2002

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...

New COSMICENERGY Malware Exploits ICS Protocol to Sabotage Power Grids

A new strain of malicious software that's engineered to penetrate and disrupt critical systems in industrial environments has been unearthed. Google-owned threat intelligence firm Mandiant dubbed the malware COSMICENERGY, adding it was uploaded to the VirusTotal public malware scanning utility in...

Oracle Linux 8 : olcne (ELSA-2023-23648)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-23648 advisory. - CVE-2022-27496 - CVE-2022-27488 - CVE-2022-27493 - CVE-2022-27492 - CVE-2022-27491 - CVE-2022-27487 Tenable has extracted the preceding description...