(Pwn2Own) Western Digital MyCloud PR4100 RESTSDK Server-Side Request Forgery Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100 NAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RESTSDK server. The issue results from the lack...

PT-2024-7970 · Eclipse · Eclipse Vert.X

Name of the Vulnerable Software and Affected Versions: Eclipse Vert.x affected versions not specified Description: A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name, the default...

CSAM Strengthens Attack Surface Coverage and Risk Assessment With Third-Party Connectors

Organizations using Qualys CyberSecurity Asset Management CSAM can now import asset data from any external system into the Enterprise TruRisk Platform. With third-party connectors, you will identify any existing coverage gaps and add business context to your unified inventory, helping you...

TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Omada ER605. Authentication is required to exploit this vulnerability. The specific issue exists within the handling of the name field in the access control user interface. The issu...

Mageia: Security Advisory (MGASA-2024-0022)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2024-0022 Updated x11-server, x11-server-xwayland and tigervnc fix security issues

The updated packages fix security vulnerabilities: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer. CVE-2023-6816 Reattaching to different master device may lead to out-of-bounds memory access. CVE-2024-0229 Heap buffer overflow in XISendDeviceHierarchyEvent. CVE-2024-21885 Heap...

Updated x11-server, x11-server-xwayland and tigervnc fix security issues

The updated packages fix security vulnerabilities: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer. CVE-2023-6816 Reattaching to different master device may lead to out-of-bounds memory access. CVE-2024-0229 Heap buffer overflow in XISendDeviceHierarchyEvent. CVE-2024-21885 Heap...

CVE-2024-22320

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM...

CVE-2023-50933

IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 275113...

Design/Logic Flaw

IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 275113...

GoAhead Web Server 2.5 HTML Injection

Exploit Title: GoAhead Web Server 2.5 - 'goform/formTest' Multiple HTML Injection Vulnerabilities Date: 25/9/2023 Exploit Author: Syed Affan Ahmed ZEROXINN Vendor Homepage: https://www.embedthis.com/goahead/ Affected Version: 2.5 may be others. Tested On Version: 2.5 in ZTE AC3630...

(Pwn2Own) Lexmark CX331adwe Missing Authentication Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX331adwe printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of authentication within the web interface. The...

(Pwn2Own) Lexmark CX331adwe make42charstring Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX331adwe printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the make42charstring method. The issue results from the lack of...

SUSE-SU-2024:0269-1 Security update for xen

This update for xen fixes the following issues: - CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts XSA-449 bsc1218851...

SUSE-SU-2024:0252-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. bsc1218845 - CVE-2024-0409: Fixed SELinux context corruption. bsc1218846...

SUSE-SU-2024:0236-1 Security update for xorg-x11-server

This update for xorg-x11-server fixes the following issues: - CVE-2024-0408: Fixed SELinux unlabeled GLX PBuffer. bsc1218845 - CVE-2024-0409: Fixed SELinux context corruption. bsc1218846...

Vulnerability of the freerdp_bitmap_planar_context_reset() function in the RDP client FreeRDP, allowing a hacker to cause a service failure

The vulnerability of the freerdpbitmapplanarcontextreset function in the FreeRDP client is related to integer overflow during the processing of the RDPGFXRESETGRAPHICSPDU message. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Trend Micro Apex One 安全漏洞

Trend Micro Apex One is the U.S. Trend Micro Trend Micro company's suite of endpoint security protection software that provides automated threat detection and response capabilities. An elevation of privilege vulnerability exists in Trend Micro Apex One, which can be exploited by a local attacker ...

Trend Micro Apex Central 安全漏洞

Trend Micro Apex Central is a Web-based product console from Trend Micro. A local file inclusion vulnerability exists in Trend Micro Apex Central, which can be exploited by an attacker to execute arbitrary code in the system context by submitting a special request...

Trend Micro Apex One 安全漏洞

Trend Micro Apex One is the U.S. Trend Micro Trend Micro company's suite of endpoint security protection software that provides automated threat detection and response capabilities. An elevation of privilege vulnerability exists in Trend Micro Apex One, which can be exploited by a local attacker ...