AMD DRI set_wm_ranges Heap Buffer Overflow DoS

Vulnerability of the setwmranges function in the drivers/gpu/drm/amd/display/dc/dcn301/dcn301resource.c file – The drivers for AMD graphics cards that support Direct Rendering Infrastructure DRI in Linux operating systems are vulnerable due to improper control of resource identifiers “resource...

drivers/gpu/drm/msm/dsi/phy/dsiPhy DRI DoS

Vulnerability of the msmdsiPhyDriverUnregister function in the drivers/gpu/drm/msm/dsi/phy/dsiPhy.c module – The driver for Linux’s Direct Rendering Infrastructure DRI architecture is vulnerable due to a NULL pointer dereferencing issue. Exploiting this vulnerability could allow an attacker to...

[SECURITY] Fedora 40 Update: zabbix-6.0.39-1.fc40

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

China Secretly (and Weirdly) Admits It Hacked US Infrastructure

Plus: The Department of Homeland Security begins surveilling immigrants' social media, President Donald Trump targets former CISA director who refuted his claims of 2020 election fraud, and more...

[SECURITY] Fedora 42 Update: zabbix-7.2.5-1.fc42

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

[SECURITY] Fedora 41 Update: zabbix-7.0.11-1.fc41

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

China-based SMS Phishing Triad Pivots to Banks

China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from Apple and Google. Until recently, the so-called "Smishing Triad " mainly impersonated toll road operators and shipping companies. But experts say these groups a...

CVE-2025-0539

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself...

golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this...

Videx CyberAudit-Web 安全漏洞

Videx CyberAudit-Web is a software suite from Videx for managing Cyberlock systems of all sizes. A security vulnerability exists in Videx CyberAudit-Web versions prior to 1.1.3 that stems from server-side request forgery and could lead to unauthorized access to infrastructure...

CVE-2025-0539: Server-Side Request Forgery (SSRF)

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself...

Octopus Deploy 安全漏洞

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Australia. A security vulnerability exists in Octopus Deploy that stems from the fact that the server can be induced to send requests containing authentication material, which could...

Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks

A previously disclosed vulnerability in NVIDIA Container Toolkit has an incomplete patch, which, if exploited, could put a wide range of AI infrastructure and sensitive data at risk...

USN-7429-2 linux-fips vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Drivers core; - HID subsystem; - Network drivers; - SCSI subsystem; - SuperH / SH-Mobile drivers; - File systems...

USN-7428-2 linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...

tp_func_xe_bo_move_name() Function DRI Data Compromise

Vulnerability of the tpfuncxebomovename function in the drivers/gpu/drm/xe/xeTraceBo.h module – The driver for supporting Direct Rendering Infrastructure DRI in Linux kernels involves the reutilization of previously released memory. Exploiting this vulnerability could allow attackers to compromis...

Year in Review: Key vulnerabilities, tools, and shifts in attacker email tactics

Over the next few weeks, we're breaking down the most critical sections of our 2024 Year in Review. This week, we examine the most frequently targeted vulnerabilities--particularly those affecting network infrastructure. We also detail a noticeable shift in adversary behavior, as threat actors mo...

Cisco Prime Infrastructure XSS

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network Manager EPNM software lies in the insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to perform...

Cisco Prime Infrastructure XSS

The vulnerability of the web interface for managing Cisco Prime Infrastructure network equipment and the Cisco Evolved Programmable Network Manager EPNM software lies in the insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to perform...

Tech Accelerator: Azure security and AI adoption

Are you looking for guidance on how to effectively integrate security best practices within your Azure and AI projects? We know the pace of technological innovation offers as many opportunities as it does challenges. However, security cannot be an afterthought as you create Azure deployments and...