USN-6851-1: Netplan vulnerabilities

Andreas Hasenack discovered that netplan incorrectly handled the permissions for netdev files containing wireguard configuration. An attacker could use this to obtain wireguard secret keys. It was discovered that netplan configuration could be manipulated into injecting arbitrary commands while...

GenAI risks to be aware of — and prepare for — according to Gartner®

The deployment of GenAI, LLMs, and chat interfaces expands potential attack surfaces and poses increased security threats...

CVE-2024-27168

It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL...

CVE-2024-27168 Hardcoded keys used to generate authentication cookies

It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL...

CVE-2024-27168

CVE-2024-27168 involves hardcoded keys used to generate authentication cookies for internal APIs on Toshiba e‑STUDIO/MFP devices. Connected sources describe that private keys may let an attacker bypass authentication and reach the administrative interfaces, enabling information disclosure or cont...

Rockwell Automation FactoryTalk View SE 安全漏洞

Rockwell Automation FactoryTalk View SE is an industrial automation system view interface from Rockwell Automation. An authentication error vulnerability exists in Rockwell Automation FactoryTalk View SE, which can be exploited by an attacker to send packets to a customer's server from a remote...

Toshiba e-STUDIO Security Vulnerability

Toshiba e-STUDIO is a series of high-end office multifunction printers from Toshiba, Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from the presence of an unauthorized method of accessing certain APIs of the multifunction device's internal programs, so that a third...

Toshiba e-STUDIO Security Vulnerability

Toshiba e-STUDIO is a series of high-end office multifunction printers from Toshiba Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from the possibility that certain APIs Application Programming Interfaces may send HTTP requests to the multifunction device without...

Toshiba e-STUDIO Security Vulnerability

Toshiba e-STUDIO is a series of high-end office multifunction printers from Toshiba, Japan. A security vulnerability exists in Toshiba e-STUDIO, which originates from an internal program within the multifunction device where certain APIs do not check for filename input, allowing arbitrary files t...

Dell Secure Connect Gateway Access Control Error Vulnerability

Dell Secure Connect Gateway is a secure connectivity gateway from Dell, Inc. An access control error vulnerability exists in Dell Secure Connect Gateway versions prior to 5.24.00.00, which stems from an improperly access controlled REST API issue that could be exploited by a remote attacker to...

Dell Secure Connect Gateway Access Control Error Vulnerability

Dell Secure Connect Gateway is a secure connectivity gateway from Dell USA. An access control error vulnerability exists in Dell Secure Connect Gateway versions prior to 5.24.00.00, which stems from an improperly access-controlled internally maintained REST API that could be exploited by a remote...

CVE-2023-52754

In the Linux kernel, the following vulnerability has been resolved: media: imon: fix access to invalid resource for the second interface imon driver probes two USB interfaces, and at the probe of the second interface, the driver assumes blindly that the first interface got bound with the same imo...

Moderate: Red Hat Security Advisory: containernetworking-plugins security and bug fix update

An update for containernetworking-plugins is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Fedora: Security Advisory for qt5-qtgraphicaleffects (FEDORA-2024-2e27372d4c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-0912

Under certain circumstances the Microsoft® Internet Information Server IIS used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions...

GO-2024-2737 IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker

IPv6 enabled on IPv4-only network interfaces in github.com/docker/docker...

[SECURITY] Fedora 40 Update: qt5-qtquickcontrols2-5.15.14-1.fc40

The Qt Labs Controls module provides a set of controls that can be used to build complete interfaces in Qt Quick. Unlike Qt Quick Controls, these controls are optimized for embedded systems and so are preferred for hardware with limited resources...

[SECURITY] Fedora 40 Update: qt5-qtcharts-5.15.14-1.fc40

Qt Charts module provides a set of easy to use chart components. It uses the Qt Graphics View Framework, therefore charts can be easily integrated to modern user interfaces. Qt Charts can be used as QWidgets, QGra phicsWidget, or QML types. Users can easily create impressive graphs by selecting o...

The vulnerability of the application programming interfaces of Google Chrome and Microsoft Edge allows a perpetrator to execute arbitrary code.

The vulnerability of the application programming interfaces of Google Chrome and Microsoft Edge relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by loading a specially created malicious HTML page...

keycloak: Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise...