Security Bulletin: IBM Storage Fusion HCI is vulnerable to denial of service, authentication bypass, and incorrect privilege assignment due to Golang vulnerabilities.

Summary IBM Storage Fusion HCI uses Golang packages that may cause Fusion to be vulnerable to denial of service, authentication bypass, and incorrect privilege assignment. CVE-2018-20699, CVE-2023-48795, CVE-2022-21698, CVE-2021-41190, CVE-2023-39325, CVE-2022-29526, CVE-2023-45288. Vulnerability...

CVE-2024-23473 SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability

The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative ZDI for its ongoing partnership in coordinating with...

CVE-2024-23473 SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability

The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability. If exploited, this vulnerability allows access to the RabbitMQ management console. We thank Trend Micro Zero Day Initiative ZDI for its ongoing partnership in coordinating with...

CVE-2024-23473

CVE-2024-23473 affects SolarWinds Access Rights Manager (ARM). The connected documents describe a hard-coded credential authentication bypass that allows remote access to the RabbitMQ management console. The vulnerability arises from the RabbitMQ configuration using hard-coded credentials, enabli...

CVE-2024-28075 SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative ZDI for its ongoing partnership in coordinating wit...

CVE-2024-28075

Summary: CVE-2024-28075 affects SolarWinds Access Rights Manager (ARM). The connected ZDI advisory and Nessus plugin confirm a deserialization flaw in the JsonSerializationBinder class that allows an authenticated, potentially bypassing authentication, attacker to execute arbitrary code on affect...

CVE-2024-28075 SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution. We thank Trend Micro Zero Day Initiative ZDI for its ongoing partnership in coordinating wit...

Delta Electronics InfraSuite Device Master

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : Delta Electronics Equipment : InfraSuite Device Master Vulnerability : Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote...

Security above all else—expanding Microsoft’s Secure Future Initiative

Last November, we launched the Secure Future Initiative SFI to prepare for the increasing scale and high stakes of cyberattacks. SFI brings together every part of Microsoft to advance cybersecurity protection across our company and products. Since then, the threat landscape has continued to rapid...

CVE-2023-50228

Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged...

CVE-2023-50197

Intel Driver & Support Assistant Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Intel Driver & Support Assistant. An attacker must first obtain the ability to execute low-privileged code on the...

CVE-2023-27356

NETGEAR RAX30 logCtrl Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the existing...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

mdanter/ecc affected by timing vulnerability in cryptographic side-channels

phpecc, as used in all versions of mdanter/ecc, as well as paragonie/ecc before 2.0.1, has a branch-based timing leak in Point addition. This Composer package is also known as phpecc/phpecc on GitHub, previously known as the Matyas Danter ECC library. Paragon Initiative Enterprises hard-forked...

USF College of Engineering Presents Rapid7 With 2024 Corporate Impact Award

This past Friday, April 19, the University of South Florida USF College of Engineering recognized individuals and organizations who have greatly impacted USF and beyond at its ninth annual Engineering Honors Awards at The Armature Works in Tampa. I had the honor of joining my colleagues, includin...

CVE-2024-31210

creationtimestamp| type| source ---|---|--- 2024-04-15 18:21:11+00:00| seen| https://t.me/ctinow/215190 2024-06-13 00:26:55+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/7632 2024-08-18 22:42:50+00:00| seen| Telegram/n32upgKdh0YO44KBbW-oOYuj3dFSmCH0Lbhaf22LxGTnsy-c 2024-08-21...

April’s Patch Tuesday Brings Record Number of Fixes

If only Patch Tuesdays came around infrequently -- like total solar eclipse rare -- instead of just creeping up on us each month like The Man in the Moon. Although to be fair, it would be tough for Microsoft to eclipse the number of vulnerabilities fixed in this months patch batch -- a record 147...

initiative-menschenrechtsstadt-koeln.de Cross Site Scripting vulnerability OBB-3897574

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Challenges Drive Career Growth: Meet Rudina Tafhasaj

Starting a career for the first time in a new country can be intimidating. For Rudina Tafhasaj, her path to Senior Application Engineer at Rapid7 was paved with both unique challenges, and incredible rewards. Growing up, Rudina was inspired to get into technology by her older brother. “He loved...

CVE-2024-27330

CVE-2024-27330 concerns PDF-XChange Editor where the EMF file parsing lacks validation, causing an out-of-bounds read. The issue can disclose sensitive information and, per sources, may enable arbitrary code execution when combined with other vulnerabilities. Exploitation requires user interactio...