org.springmodules:spring-modules-jakarta-commons (>=0.8, <=0.8a), org.springmodules:spring-modules-osworkflow (>=0.8, <=0.8a) potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (2.0.3)

org.springframework:spring-webmvc MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons =0.8, =0.8, =0.8a Source cves: CVE-2024-3881...

org.springmodules:spring-modules-jakarta-commons (0.7), org.springmodules:spring-modules-osworkflow (0.7) potentially affected by CVE-2024-38819 via org.springframework:spring-webmvc (2.0.1)

org.springframework:spring-webmvc MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons 0.7 -...

CVE-2024-12687

Deserialization of Untrusted Data vulnerability in PlexTrac Runbooks modules which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1...

PT-2024-17714

Name of the Vulnerable Software and Affected Versions PlexTrac versions 1.61.3 through 2.8.1 Description The issue is related to the deserialization of untrusted data in PlexTrac's Runbooks modules, allowing object injection and arbitrary file writes. Recommendations For versions 1.61.3 through...

CVE-2024-12687: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in PlexTrac Runbooks modules which allows Object Injection and arbitrary file writes. This issue affects PlexTrac: from 1.61.3 before 2.8.1...

CVE-2024-11839: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in PlexTrac Runbooks modules which allows Object Injection and arbitrary file writes.This issue affects PlexTrac: from 1.61.3 before 2.8.1...

PT-2024-17286

Name of the Vulnerable Software and Affected Versions PlexTrac versions 1.61.3 through 2.8.1 Description The issue is related to the deserialization of untrusted data in PlexTrac, specifically in the Runbooks modules, allowing object injection and arbitrary file writes. This enables attackers to...

CVE-2024-45494

The MSA FieldServer Gateway (versions 5.0.0 through 6.5.2 ) is vulnerable to an authentication bypass because it utilizes an internally used shared administrative user account across all devices. The security flaw stems from the use of an unsafe, static shared secret for this account's authentica...

CVE-2024-45493

An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 Fixed in 7.0.0. The FieldServer Gateway has internal users, whose access is supposed to be restricted to login locally on the device. However, an attacker can bypass the check for this, which might allow them to authenticate...

GO-2024-3312 CA certificate sign check bypass in github.com/canonical/lxd

CA certificate sign check bypass in github.com/canonical/lxd...

ROS-20241209-02

A vulnerability in some IntelR TDX modules is related to improper input validation. Exploitation of the vulnerability could allow a privileged attacker to potentially escalate privileges through local access. Vulnerability related to processor instruction sequencing causes unexpected behavior on...

MAL-2024-11324 Malicious code in cap1-modules (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in cap1-modules (npm)

--- -= Per source details. Do not edit below this line.=-...

Metasploit Weekly Wrap-Up 12/06/2024

Post-Thanksgiving Big Release This week's release is an impressive one. It adds 9 new modules, which will get you remote code execution on products such as Ivanti Connect Secure, VMware vCenter Server, Asterisk, Fortinet FortiManager and Acronis Cyber Protect. It also includes an account takeover...

Is secure boot on the main application processor enough?

TL;DR Secure boot ensures only authentic firmware can run on a device and should form part of a layered defence strategy. Sub-systems often lack secure boot capabilities, limiting protection for non-critical processors. Focus on secure boot for the main processor; it can provide adequate security...

PT-2024-35145 · Tenda · Tenda Ac6V2

Name of the Vulnerable Software and Affected Versions: Tenda AC6V2 versions through 15.03.06.50 Description: The issue is a Stack-based Buffer Overflow vulnerability in the WizardHandle modules of Tenda AC6V2, allowing buffer overflows. Recommendations: For versions through 15.03.06.50, consider...

MELSEC iQ-F Ethernet module Software Input Validation

The vulnerability of MELSEC iQ-F Ethernet module software and EtherNet/IP modules is related to improper validation of specified types of input data. Exploiting this vulnerability can allow an attacker to trigger a service failure by sending specially crafted SLMP packets...

zhmc-ansible-modules (0.2.0) potentially affected by CVE-2024-53865 via zhmcclient (1.7.2)

zhmcclient PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on zhmcclient and may be impacted: - zhmc-ansible-modules 0.2.0 Source cves: CVE-2024-53865 Source advisory: GHSA-P57H-3CMC-XPJQ...

zhmc-ansible-modules (0.2.0) potentially affected by CVE-2024-53865 via zhmcclient (1.7.2)

zhmcclient PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on zhmcclient and may be impacted: - zhmc-ansible-modules 0.2.0 Source cves: CVE-2024-53865 Source advisory: OSV:GHSA-P57H-3CMC-XPJQ...

zhmc-ansible-modules (0.2.0) potentially affected by CVE-2024-53865 via zhmcclient (1.7.2)

zhmcclient PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on zhmcclient and may be impacted: - zhmc-ansible-modules 0.2.0 Source cves: CVE-2024-53865 Source advisory: SNYK:PYTHON-ZHMCCLIENT-8445279...