9306 matches found
Apple Warns of 3 New Vulnerabilities Affecting iPhone, iPad, and Mac Devices
Apple has revised the security advisories it released last month to include three new vulnerabilities impacting iOS, iPadOS, and macOS. The first flaw is a race condition in the Crash Reporter component CVE-2023-23520 that could enable a malicious actor to read arbitrary files as root. The iPhone...
U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added three security flaws to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The list of shortcomings is as follows - CVE-2022-47986 CVSS score: 9.8 - IBM Aspera Faspex Code...
VMware Patches Critical Vulnerability in Carbon Black App Control Product
VMware on Tuesday released patches to address a critical security vulnerability affecting its Carbon Black App Control product. Tracked as CVE-2023-20858, the shortcoming carries a CVSS score of 9.1 out of a maximum of 10 and impacts App Control versions 8.7.x, 8.8.x, and 8.9.x. The virtualizatio...
VMware vRealize Orchestrator 代码问题漏洞
VMware vRealize Orchestrator is a workflow automation solution from VMware. It is designed to simplify the automation of complex IT tasks. A security vulnerability exists in VMware vRealize Orchestrator that originated when a malicious actor with unmanaged access to vRealize Orchestrator was able...
Apache Kerby LDAP Injection Vulnerability
Apache Kerby is a Java Kerberos binding from the Apache Foundation, USA. Provides rich, intuitive, and interoperable implementations, libraries, KDCs, and facilities to integrate PKI, OTP, and tokens OAuth2 as needed for modern environments such as cloud, Hadoop, and mobile. An LDAP injection...
Mozilla: Fullscreen notification not shown in Firefox Focus
The Mozilla Foundation Security Advisory describes this flaw as: A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome. This bug only affects Firefox Focus. Other versions of Firefox are unaffected...
Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry
The Mozilla Foundation Security Advisory describes this flaw as: An invalid downcast from nsTextNode to SVGElement could have lead to undefined behavior...
Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext
The Mozilla Foundation Security Advisory describes this flaw as: Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in ScriptLoadContext...
Mozilla: Web Crypto ImportKey crashes tab
The Mozilla Foundation Security Advisory describes this flaw as: When importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash...
Mozilla: Fullscreen notification not shown in Firefox Focus
The Mozilla Foundation Security Advisory describes this flaw as: A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chrome. This bug only affects Firefox Focus. Other versions of Firefox are unaffected...
Mozilla PollBot open redirect vulnerability
Mozilla PollBot is a microservice from the Mozilla Foundation. Freeing humans from the onerous task of polling for status during Firefox releases, Mozilla PollBot versions prior to 1.4.6 have an open redirect vulnerability that stems from the system not doing a reasonable job of targeting jumps,...
Malicious code in flow-faucet (npm)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0cff9be7c9c3ff28671b9dcf41cf2da25e5f96e860a1c0a8e6d0be715487071b Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...
Mozilla Firefox and Thunderbird Denial of Service Vulnerability
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A denial of service vulnerability exists in Mozilla Firefox versions prior to 106, Firefox ESR versions prior to 102.4, and Thunderbird versions prior to 102.4. An attacker could exploit this...
Mozilla Firefox Elevation of Privilege Vulnerability (CNVD-2023-17318)
Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. An elevation of privilege vulnerability exists in versions of Mozilla Firefox prior to 96.0. An attacker could exploit this vulnerability to elevate privileges by making the program search for system libraries i...
Security Bulletin: Multiple vulnerabilities found with third-party libraries used by IBM® MobileFirst Platform
Summary There are multiple vulnerabilities in open source libraries used by IBM MobileFirst Platform Foundation. They are addressed in this update. Vulnerability Details CVEID:CVE-2022-3517 DESCRIPTION: minimatch is vulnerable to a denial of service, caused by a regular expression denial of servi...
Apache Sling JNDI Injection Vulnerability
Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...
Microsoft Team Foundation Server and Azure DevOps Server 2020 RCE
The Microsoft Team Foundation Server or Azure DevOps install is missing security updates. It is, therefore, affected by a remote code execution vulnerability. Note all systems require a manual process of applying new resource group tasks. Nessus is unable to detect the state of the tasks at this...
Apache Kafka Code Issue Vulnerability (CNVD-2023-23554)
Apache Kafka is an open source distributed streaming platform from the Apache Foundation in the United States. The platform is capable of acquiring real-time data for building applications that react in real time to changes in the data stream. A code issue vulnerability exists in Apache Kafka...
Apache ShenYu Authorization Problem Vulnerability (CNVD-2023-23553)
Apache ShenYu is an asynchronous , high-performance , cross-language , responsive API gateway of the United States Apache Apache Foundation . An authorization issue vulnerability exists in Apache ShenYu versions prior to 2.5.1, which stems from improper privilege management and can be exploited b...
