CVE-2024-12086

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare wi...

CVE-2024-12085

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length s2length to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. Mitigation Seei...

CVE-2024-12084

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths s2length in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH 16 bytes, an attacker can write out of bounds in the sum2 buffer. Mitigation Red Hat...

Schneider Electric EcoStruxure Power Build Rapsody

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

PT-2025-2780 · Unknown · Graphics Ddk

Name of the Vulnerable Software and Affected Versions: Graphics DDK version = 24.2 RTM2 Description: The kernel software installed and running inside a guest virtual machine VM can send improper commands to the GPU firmware, allowing it to read data outside the guest's virtualized GPU memory. Thi...

CISA: OBP Training Fact Sheet

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: Mitigating Attacks on Houses of Worship Security Guide - Simplified Chinese Translation

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: BMAP Fact Sheet

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: International Chemical Security Framework

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: Mitigating Attacks on Houses of Worship Security Guide - Spanish Translation

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA: IST Fact Sheet

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

CISA Releases Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems ICS advisories on January 10, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-010-01 Schneider Electric PowerChute Serial Shutdown ICSA-25-010-02 Schneider Electri...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400 Vulnerability PoC Verification Tool Vulner...

AMD Client UEFI Firmware – SMM Lock Bypass

AMD has informed HP of a potential security vulnerability identified in some AMD client platform firmware components, which might allow arbitrary code execution. AMD has released firmware updates to mitigate these vulnerabilities. AMD has released updates to mitigate this potential vulnerability...

Secure, Efficient, Cost-Effective: How Qualys Patch Management Delivers ROI

As demonstrated by real user reviews from PeerSpot Organizations face increasing challenges in managing cyber threats and deploying the tools necessary to detect, protect, and mitigate vulnerabilities. Patch management, a critical component of cybersecurity, often falls victim to resource...

PT-2025-4440 · Unknown · Nik Chankov Autocompleter

Name of the Vulnerable Software and Affected Versions: Nik Chankov Autocompleter versions 1.3.5.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on ...

CVE-2025-21613

An argument injection vulnerability was found in go-git. This flaw allows an attacker to set arbitrary values to git-upload-pack flags, leading to command or code execution, exposure of sensitive data, or other unintended behavior. This is only possible in configurations where the file transport...

GHSA-HWCP-2H35-P66W PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

Cross-Site Scripting XSS vulnerability of the hyperlink base in the HTML page header Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS...

PhpSpreadsheet allows unauthorized Reflected XSS in the constructor of the Downloader class

Unauthorized Reflected XSS in the constructor of the Downloader class Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 8.2 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS vector v.4.0: 8.3...

CVE-2024-56320 GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user

GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the admin "Configuration XML" UI feature, and its associated API. A malicious insider/existing authenticated GoCD user with an existing GoCD...