UBUNTU-CVE-2024-10383

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6,...

CVE-2024-10383 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6,...

The vulnerability of the Firewall component of the MySQL Enterprise Firewall software allows a hacker to induce a service failure.

The vulnerability of the MySQL Enterprise Firewall component is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause downtime or service failures using the MySQL network protocol...

CVE-2022-33174

Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...

[SECURITY] [DSA 5858-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5858-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 05, 2025 https://www.debian.org/security/faq -...

CVE-2024-30258

FastDDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8, when a publisher serves a malformed RTPS packet, the subscriber crashes when creating pthread. This can remotely crash any Fast-DD...

CVE-2024-6035

A Stored Cross-Site Scripting XSS vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser...

The vulnerability of the ogs_dbi_auth_info() function (lib/dbi/subscription.c), which is used for creating and managing the NR/LTE Open5GS mobile network, allows a perpetrator to cause a service failure.

The vulnerability of the ogsdbiauthinfo function lib/dbi/subscription.c, which is used for creating and managing the NR/LTE Open5GS mobile network, is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

One policy to rule them all

Windows group policies are a powerful management tool that allows administrators to define and control user and computer settings within a domain environment in a centralized manner. While group policies offer functionality and utility, they are unfortunately a prime target for attackers. In...

CVE-2024-42671

CVE-2024-42671 affects slabiak Appointment Scheduler v1.0.5. The issue is a Host Header Poisoning Open Redirect, enabling remote redirection to a malicious site. The CVSS base score is 6.1 (Medium) with Network attack vector, no privileges, user interaction required, and a changed scope; impact i...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

CVE-2024-42671

A Host Header Poisoning Open Redirect issue in slabiak Appointment Scheduler v.1.0.5 allows a remote attacker to redirect users to a malicious website, leading to potential credential theft, malware distribution, or other malicious activities...

Fake Reddit and WeTransfer Sites are Pushing Malware

There are thousands of fake Reddit and WeTransfer webpages that are pushing malware. They exploit people who are using search engines to search sites like Reddit. Unsuspecting victims clicking on the link are taken to a fake WeTransfer site that mimicks the interface of the popular file-sharing...

No need to RSVP: a closer look at the Tria stealer campaign

Introduction Since mid-2024, we've observed a malicious Android campaign leveraging wedding invitations as a lure to social-engineer victims into installing a malicious Android app APK, which we have named "Tria Stealer" after unique strings found in campaign samples. The primary targets of the...

Lumma Stealer’s GitHub-Based Delivery Explored via Managed Detection and Response

The Managed XDR team investigated a sophisticated campaign distributing Lumma Stealer through GitHub, where attackers leveraged the platform's release infrastructure to deliver malware such as SectopRAT, Vidar, and Cobeacon...

Important: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.7.3 security updates and bug fixes

Multicluster Engine for Kubernetes 2.7.3 General Availability release images, which provide enhancements, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

The vulnerability of the IBM Safer Payments security measure lies in its ability to allow unlimited distribution of resources, which enables a perpetrator to trigger a service failure.

The vulnerability of the IBM Safer Payments security tool is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the `saveRequestFiles` function in the Fastify JavaScript software framework allows a hacker to trigger a service failure.

The vulnerability of the saveRequestFiles function in the Fastify JavaScript software framework is related to the use of incorrect authentication tokens due to unlimited resource distribution. Exploiting this vulnerability could allow a malicious actor to cause service failures by sending special...