MAL-2024-1360 Malicious code in by-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aee582797b8e77f812713bd6e5ef7f9d3f69f9b2b3dc46f1a078c970264de320 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1358 Malicious code in @asdfvr/qaqazzaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00ddae9d7021daf95bf5000e1b7f278bcf84e7b46ceba0a5ed05943b9d7ebf57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1363 Malicious code in input-fns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d97cebe2b3c5f99612c7086d455844599d1f9afef3e76c1c74b54de73ad1ad9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

RHEL 9 : golang (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 - Angle brackets are not...

RHEL 6 : cloud-init (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cloud-init: default configuration disabled deletion of SSH host keys CVE-2018-10896 - cloud-init through...

RHEL 5 : nss (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nss: Use-after-free in sftkFreeSession due to improper refcounting CVE-2019-11756 - nss: CHACHA20-POLY130...

RHEL 8 : libreoffice (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libreoffice: Weak Master Keys CVE-2022-26307 - An Improper Certificate Validation vulnerability in...

RHEL 8 : libtpms (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libtpms: out-of-bounds access when trying to resume the state of the vTPM CVE-2021-3623 - A flaw was foun...

CVE-2024-22064 Configuration error Vulnerability in ZTE ZXUN-ePDG

ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connectionIKE with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the...

CVE-2024-22064 Configuration error Vulnerability in ZTE ZXUN-ePDG

ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connectionIKE with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the...

CVE-2024-22064

CVE-2024-22064 affects ZTE ZXUN-ePDG, a network node for the VoWifi system. The vulnerability arises from by-default configuration that uses a set of non-unique cryptographic keys during establishing a secure IKE connection with mobile devices. If these keys are leaked or cracked, user session in...

PT-2024-19178 · Zte · Zxun-Epdg

Name of the Vulnerable Software and Affected Versions: ZTE ZXUN-ePDG product versions up to 5.20.19 Description: The ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, uses a set of non-unique cryptographic keys by default configuration when establishing a secure...

OfferBox 安全漏洞

OfferBox is a recruiting application from OfferBox, Inc. OfferBox has a security vulnerability that stems from the use of hard-coded keys...

Huawei EulerOS: Security Advisory for linux-sgx (EulerOS-SA-2024-1596)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2024-1354 Malicious code in @content-platform/fadam-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38b39e3ee36cc6bc7c45845d588a859e0f041b0ecbc3caaebd1ff022e1fe7132 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-25809 · 1Panel · 1Panel

Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.10.3-lts Description: The issue is related to command injections in the project that are not well filtered, leading to arbitrary file writes and ultimately to remote code executions RCEs. The mirror configuration...

EulerOS 2.0 SP10 : linux-sgx (EulerOS-SA-2024-1596)

According to the versions of the linux-sgx packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact...

Microsoft PlayReady Complete Client Identity Compromise

Hello All, We have come up with two attack scenarios that make it possible to extract private ECC keys used by a PlayReady client Windows SW DRM scenario for the communication with a license server and identity purposes. More specifically, we successfully demonstrated the extraction of the...

MAL-2024-1342 Malicious code in @assistedtax/demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec2972fb44126ef7f02e56ab9b4935acea7521aebc2b5ef541889cb59b6bcd20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Spectre-Style 'Pathfinder' Attack Targets Intel CPU, Leak Encryption Keys and Data

Researchers have discovered two novel attack methods targeting high-performance Intel CPUs that could be exploited to stage a key recovery attack against the Advanced Encryption Standard AES algorithm. The techniques have been collectively dubbed Pathfinder by a group of academics from the...