Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from improper use of userspaceirqchipinuse in the KVM subsystem...

The vulnerability of the DIAScreen component within the integrated engineering software package DIAStudio Smart Machine Suite allows a perpetrator to execute arbitrary code.

The vulnerability of the DIAScreen component in the integrated engineering software package DIAStudio Smart Machine Suite of Delta Electronics is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the DIAScreen component within the integrated engineering software package DIAStudio Smart Machine Suite allows a perpetrator to execute arbitrary code.

The vulnerability of the DIAScreen component in the integrated engineering software package DIAStudio Smart Machine Suite of Delta Electronics is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the DIAScreen component within the integrated engineering software package DIAStudio Smart Machine Suite allows a perpetrator to execute arbitrary code.

The vulnerability of the DIAScreen component in the integrated engineering software package DIAStudio Smart Machine Suite of Delta Electronics is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2024-12902

ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default...

CVE-2024-12902

The CVE covers Global Wisdom Software ANCHOR running on a Windows VM, where default passwords on high-privilege Windows service accounts could let an attacker remotely log in to the VM. Public documents confirm the vulnerability vector as remote access via default credentials, driven by OS-level ...

CVE-2024-12902 Global Wisdom Software ANCHOR - Undocumented Privileged Account

ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default...

SUSE CVE-2024-11614

An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows an attacker with a malicious VM using...

Malicious code in private-bug-bounty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a00733ed27d2b66f512559495dc079196948c176ea93c337042bed009427afc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dhp-http-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e3bd8d790ed5b426b7b312480732dc8343670572c60141f63f9a0d7df7b8efe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in woodpecker-ci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cff5749234f2b25995b0c9e8c5b6baa0434340fe0646aa21e19eef1e6612812a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-sns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dde2984debaba750af691ea1ba70116984fba098ecf0fe26a0fdf576d386f53a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory

In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory Ignore nCR34:0 when loading PDPTEs from memory for nested SVM, as bits 4:0 of CR3 are ignored when PAE paging is used, and thus VMRUN doesn't enforce 32-byte alignment of...

kernel: vmci: prevent speculation leaks by sanitizing event in event_deliver()

A vulnerability was found in the eventdeliver function in the Linux kernel's VMCI component, where the issue involves a lack of sanitization for the eventdata.event index controlled by user-space, which could lead to speculative information leaks...

Malicious code in alifx-media-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8716d89d3543726f75604dccfd9a5ab777f48047bb3aa028cdc047c77d1b9dc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: python-virtualenv security update

An update for python-virtualenv is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Malicious code in openai-realtime-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63903b0e2f2b97ef7bde23b987c10da50353b221fdaa4036434af2c3c6e1ab47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CISA and EPA Release Joint Fact Sheet Detailing Risks Internet-Exposed HMIs Pose to WWS Sector

Today, CISA and the Environmental Protection Agency EPA released Internet-Exposed HMIs Pose Cybersecurity Risks to Water and Wastewater Systems. This joint fact sheet provides Water and Wastewater Systems WWS facilities with recommendations for limiting the exposure of Human Machine Interfaces HM...

Virtuozzo Hybrid Server 7.5 Update 7 Hotfix 1 (7.5.7-151)

The Hotfix 1 for Virtuozzo Hybrid Server 7.5 Update 7 provides new features, as well as stability and usability bug fixes. Vulnerability id: PSBM-159866 Fixed an issue with the 'c2v-convert' tool failing while creating a filesystem for a virtual machine's disk. Vulnerability id: PSBM-159824 The...

SAMR Account Management

Add, lookup and delete user / machine accounts via MS-SAMR. By default standard active directory users can add up to 10 new computers to the domain MachineAccountQuota. Administrative privileges however are required to delete the created accounts, or to create/delete user accounts. Module Options...