Lenovo printers 安全漏洞

Lenovo printers is a printer from the Chinese company Lenovo Lenovo. A security vulnerability exists in Lenovo printers that stems from the presence of a denial-of-service vulnerability, which could allow an unauthenticated attacker on a shared network to disrupt printer communications until the...

Siemens SINEC Traffic Analyzer Access Control Error Vulnerability

SINEC Traffic Analyzer is an on-premise application that monitors PNIO PROFINET IO communications between controllers and IO devices. An access control error vulnerability exists in Siemens SINEC Traffic Analyzer, which can be exploited by a low-privileged, authenticated attacker to access...

CVE-2023-26211

An improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiSOAR 7.3.0 through 7.3.2 allows an authenticated, remote attacker to inject arbitrary web script or HTML via the Communications module...

CVE-2023-26211

CVE-2023-26211 : Fortinet FortiSOAR versions 7.3.0–7.3.2 are affected by a cross-site scripting vulnerability caused by improper neutralization of input during web page generation in the Communications module. An authenticated, remote attacker can inject arbitrary web script/HTML via this module....

PT-2024-6590 · Rockwell Automation · Compactlogix +2

Name of the Vulnerable Software and Affected Versions: Rockwell Automation CompactLogix versions affected versions not specified Rockwell Automation ControlLogix versions affected versions not specified Rockwell Automation GuardLogix versions affected versions not specified Description: A...

PT-2024-9830 · Cisco · Cisco Unified Communications Manager Session Management Edition +1

Name of the Vulnerable Software and Affected Versions: Cisco Unified Communications Manager versions prior to the fixed version Cisco Unified Communications Manager Session Management Edition versions prior to the fixed version Description: The issue is related to a lack of input validation in th...

Johnson Controls exacqVision Web Service < 24.06 Multiple Vulnerabilities

The version of the Johnson Controls exacqVision Web Service running on the remote host is prior to 24.03. It is, therefore, affected by multiple vulnerabilities. - Under certain circumstances the exacqVision Web Services does not provide sufficient protection from untrusted domains. CVE-2024-3286...

FBI and CISA Warn of BlackSuit Ransomware That Demands Up to $500 Million

The ransomware strain known as BlackSuit has demanded as much as $500 million in ransoms to date, with one individual ransom demand hitting $60 million. That's according to an updated advisory from the U.S. Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of...

New Android Spyware LianSpy Evades Detection Using Yandex Cloud

Users in Russia have been the target of a previously undocumented Android post-compromise spyware called LianSpy since at least 2021. Cybersecurity vendor Kaspersky, which discovered the malware in March 2024, noted its use of Yandex Cloud, a Russian cloud service, for command-and-control C2...

CVE-2024-39229

An issue in GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, XE3000/X3000 v4, and B2200/MV1000/MV1000W/USB150/N300/SF1200 v3.216 allows attackers to...

Man-in-the-middle (MitM) Attack

github.com/codenotary/immudb is vulnerable to a man-in-the-middle MitM attack. The vulnerability is due to the use of the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, which allows an attacker to intercept communications between the client and server...

CVE-2024-32931

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications...

CVE-2024-32931

Summary of CVE-2024-32931 : Johnson Controls exacqVision Web Service (versions up to 24.03) may expose authentication token details in communications, via use of GET requests with sensitive query strings. The issue has a CVSS v3.1 base score of 5.7 (Network, Low complexity, Privileges Low, User I...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864 exacqVison - HTTPS Session Establishment

Under certain circumstances exacqVision Web Services will not enforce secure web communications HTTPS...

CVE-2024-32864

Summary: CVE-2024-32864 affects Johnson Controls exacqVision Web Service prior to version 24.06, where HTTPS is not enforced under certain conditions, enabling potential exposure of sensitive information via cleartext transmission (CWE-319). The vulnerability affects exacqVision Web Service versi...

Malicious code in wix-smarts-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84e76a9b6116099c21d8ddfc842416facd8c4f184bcc94730e519e32c6f9c34e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel: GSM multiplexing race condition leads to privilege escalation

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOCSETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsmdlci while restarting th...

Oracle Critical Patch Update, July 2024 Security Update Review

Oracle released its third quarterly edition of Critical Patch Update, which contains patches for 386 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-part...