CVE-2024-38499 Improper Privilege Management Vulnerability in CA Client Automation 14.5

CA Client Automation ITCM allows non-admin/non-root users to encrypt a string using CAF CLI and SDACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to...

CVE-2024-38499

CA Client Automation (ITCM) vulnerability CVE-2024-38499 involves improper privilege management that allows non-admin/non-root users to encrypt strings via CAF CLI and SD_ACMD CLI. This could expose encryption keys and enable credential compromise. The available fix prevents non-admin/non-root us...

Broadcom CA Client Automation 安全漏洞

Broadcom CA Client Automation is a suite of IT asset management solutions from Broadcom USA. A security vulnerability exists in Broadcom CA Client Automation. An attacker could exploit the vulnerability to gain access to critical encryption keys...

"Windows Script Host must be enabled for the duration of setup process"

Challenge While attempting to Install or Upgrade Veeam Backup & Replication, the installer displays the message: Windows Script Host must be enabled for the duration of setup process, Refer to KB4699 for more information https:// www.veeam.com/kb4699. Cause This message is displayed when the...

Exploit for Path Traversal in Grafana

Automated Exploit Tool for Grafana CVE-2021-43798 !Previewi...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2023-52524: net: nfc: llcp: Add lock when modifying device list bsc1220927. CVE-2024-49925: fbdev: efifb: Register sysfs groups through driver core bsc1232224...

MAL-2024-11833 Malicious code in imran-servar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9af64e8c6963a1d384ffab6087780576331442e9e8c79eda2f18e092b02b52d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11817 Malicious code in planweb-core-ui (npm)

This package contains code to download a second stage payload which establishes a C2 connection and persistence via registry keys. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acc967a53ff92a71f6b9518c692bf641aa3595a3b65f28cc403b471c0474b175 Any computer that has...

security/keys: fix slab-out-of-bounds in key_task_permission

...

AZL-54353 CVE-2024-45337 affecting package cri-o 1.30.1-1

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

Amazon Linux 2023 : grpc, grpc-cpp, grpc-data (ALAS2023-2024-769)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-769 advisory. It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this...

Malicious code in dhp-logging-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware def2cfdcf7555dce8bc6545670a20f1748d6588683a817bc7d922f42c8e9cd43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Making sure your door access control system is secure: Top 5 things to check

Your door access control system aka a physical access control system or PACS, also referred to as RFID cards or ‘swipe’ cards often have a poor reputation for being vulnerable to cloning attacks. Here’s the thing: it’s generally possible to configure your system to be very resistant to card...

SUSE: Security Advisory (SUSE-SU-2024:4079-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-55560

MailCleaner before 28d913e has default values of sshhostdsakey, sshhostrsakey, and sshhosted25519key that persist after installation...

CVE-2024-55560

MailCleaner before 28d913e has default values of sshhostdsakey, sshhostrsakey, and sshhosted25519key that persist after installation...

CVE-2024-55560

MailCleaner before 28d913e has default values of sshhostdsakey, sshhostrsakey, and sshhosted25519key that persist after installation...

CVE-2024-55560

CVE-2024-55560 affects MailCleaner versions before 28d913e, where the default SSH host keys (ssh_host_dsa_key, ssh_host_rsa_key, ssh_host_ed25519_key) persist after installation. The underlying issue is the continued presence of these default keys, which can enable unauthorized access to the devi...

PT-2024-36555 · Unknown · Mailcleaner

Name of the Vulnerable Software and Affected Versions: MailCleaner versions before 28d913e Description: The issue concerns default values of ssh host dsa key, ssh host rsa key, and ssh host ed25519 key that persist after installation. Recommendations: For versions before 28d913e, update to a...

MailCleaner 安全漏洞

MailCleaner is an anti-virus e-mail gateway from MailCleaner, Inc. MailCleaner has a security vulnerability that originates from the default values of sshhostdsakey, sshhostrsakey, and sshhosted25519key not being changed after installation...