LodaRAT: Established Malware, New Victim Patterns

Executive Summary Rapid7 has observed an ongoing malware campaign involving a new version of LodaRAT. This version possesses the ability to steal cookies and passwords from Microsoft Edge and Brave. LodaRAT, first observed in 2016, is a remote access tool RAT written in AutoIt. Development of...

kernel: ipv4: Fix uninit-value access in __ip_make_skb()

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in ipmakeskb KMSAN reported uninit-value access in ipmakeskb 1. ipmakeskb tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt2 with...

November 12, 2024—KB5046633 (OS Builds 22621.4460 and 22631.4460)

None None...

November 12, 2024—KB5046661 (Monthly Rollup)

None None...

November 12, 2024—KB5046617 (OS Build 26100.2314) for Windows

None None...

November 12, 2024—KB5046616 (OS Build 20348.2849)

None None...

PT-2024-8039 · Adobe · Substance3D - Painter

Name of the Vulnerable Software and Affected Versions: Substance3D - Painter versions 10.1.0 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires...

PT-2024-41057 · Unknown · Qbittorrent

Name of the Vulnerable Software and Affected Versions: qBittorrent affected versions not specified Description: The issue concerns the failure to verify SSL certificates in the DownloadManager class. Specifically, if the verification of a certificate failed, the application would log an error and...

PT-2024-8515

Name of the Vulnerable Software and Affected Versions Citrix Virtual Apps and Desktops CVAD versions 1912 LTSR, 2203, 2402, and 2407 Description The issue is related to insecure privilege management in the Session Recording component of Citrix Virtual Apps and Desktops CVAD, allowing an attacker ...

PT-2024-16121 · Tibco · Tibco Operational Intelligence +1

Name of the Vulnerable Software and Affected Versions: TIBCO Hawk and TIBCO Operational Intelligence affected versions not specified Description: A Cross-Site Scripting XSS vulnerability is present in mar.jar and monitoringconsolecommon.jar. This issue allows for potential system manipulation,...

Synology DiskStation Manager (DSM) File Write Vulnerability (Synology-SA-24:20) - Remote Known Vulnerable Versions Check

Synology DiskStation Manager DSM is prone to a file write vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Synology DiskStation Manager (DSM) RCE Vulnerability (Synology-SA-24:20) - Remote Known Vulnerable Versions Check

Synology DiskStation Manager DSM is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2024-34386 · Trendnet · Trendnet Tew-820Ap

Name of the Vulnerable Software and Affected Versions: Trendnet TEW-820AP version 1.01.B01 Description: The issue is related to a stack overflow vulnerability in the boa httpd. Specifically, the vulnerability is found in the /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, and /boafrm/formDnsv6 API...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

Updated November 8, 2024 CISA has removed the following vulnerability from its Known Exploited Vulnerabilities Catalog, due to a transcription error: CVE-2021-4043link is external Motion Spell GPAC Null Pointer Dereference Vulnerability End of Update CISA has added four new vulnerabilities to its...

Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities

Summary QRadar Suite Software includes components with known vulnerabilities. These have been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the Remediation/Fixes section below to update to the latest version. Vulnerability Details...

CVE-2024-51751 Arbitrary file read with File and UploadButton components in Gradio

Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary file...

PT-2024-18674 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Description: A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. This issue is due to insufficient validatio...

Fedora 39 : syncthing (2024-4fc7cdc194)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4fc7cdc194 advisory. Update to version 1.28.0. Release notes: https://github.com/syncthing/syncthing/releases/tag/v1.28.0 Tenable has extracted the preceding description...

PT-2024-12195 · Enel X · Waybox Enel X Web Management Application

Name of the Vulnerable Software and Affected Versions: Waybox Enel X Web management application affected versions not specified Description: The issue concerns a denial-of-service condition in the Waybox Enel X Web management application, where a specific request could cause the system to reboot...

PT-2024-40625 · Git +1 · Clamav

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash reported by OSS-Fuzz, with a Segv on an unknown address. The crash state includes functions such as yara yyparse, yr lex...