pcp: pmcd heap corruption through metric pmstore operations

A vulnerability was found in Performance Co-Pilot PCP. This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash...

Performance Co-Pilot security vulnerabilities

Performance Co-Pilot is an open source software infrastructure for monitoring, visualizing, logging, responding to, and controlling the state, activity, and performance of networks, computers, applications, and servers. Performance Co-Pilot has a security vulnerability that stems from the ability...

DEBIAN-CVE-2024-46759

In the Linux kernel, the following vulnerability has been resolved: hwmon: adc128d818 Fix underflows seen when writing limit attributes DIVROUNDCLOSEST after kstrtol results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering...

UBUNTU-CVE-2024-46768

In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore t...

Cyber threats to shipping explained

TL;DR Modern vessels are becoming increasingly connected. While it is unlikely that hackers could fully control a container ship remotely, they may be able to disrupt systems such as the Power Management System PMS, leading to blackouts and associated loss of propulsion and steering. Although...

Pandora FMS SQL Injection Unauthorized Access

The vulnerability of the Pandora FMS system’s monitoring and management interface relates to the improper processing of SQL query headers. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries and gain unauthorized access to protected information...

CVE-2024-45605 Improper authorization on deletion of user issue alert notifications in sentry

Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on requests to delete user alert...

Binance Warns of Rising Clipper Malware Attacks Targeting Cryptocurrency Users

Cryptocurrency exchange Binance is warning of an "ongoing" global threat that's targeting cryptocurrency users with clipper malware with the goal of facilitating financial fraud. Clipper malware, also called ClipBankers, is a type of malware that Microsoft calls cryware, which comes with...

FactoryTalk Batch View Authentication Bypass

The vulnerability of FactoryTalk Batch View’s software for managing and monitoring manufacturing processes in real-time is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers to circumvent existing security restrictions remotely...

23andMe to pay $30 million in settlement over 2023 data breach

Genetic testing company 23andMe will pay $30 million to settle a class action lawsuit over a 2023 data breach which ended in some customers having information like names, birth years, and ancestry information exposed. In October 2023, we reported on how information belonging to as many as seven...

Master Your PCI DSS v4 Compliance with Innovative Smart Approvals

The PCI DSS landscape is evolving rapidly. With the Q1 2025 deadline looming ever larger, businesses are scrambling to meet the stringent new requirements of PCI DSS v4.0. Two sections in particular, 6.4.3 and 11.6.1, are troublesome as they demand that organizations rigorously monitor and manage...

IBM QRadar Suite Security Analytics Unencrypted Credentials

The vulnerabilities of event monitoring platforms, threat detection systems, and security analytics tools from IBM QRadar Suite and IBM Cloud Pak for Security are related to the unencrypted storage of user credentials. Exploiting these vulnerabilities can allow attackers operating remotely to gai...

IBM QRadar Suite Information Disclosure

The vulnerabilities of event monitoring platforms, threat detection systems, and security analytics tools from IBM QRadar Suite and IBM Cloud Pak for Security are related to information leaks through the process environment. Exploiting these vulnerabilities can allow attackers operating remotely ...

[SECURITY] Fedora 41 Update: haproxy-3.0.4-1.fc41

HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...

Security Bulletin: Vulnerabilities in IBM Java included with IBM Tivoli Monitoring.

Summary Vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. CVEs: CVE-2024-21147, CVE-2024-21145, CVE-2024-21140, CVE-2024-21144, CVE-2024-21138, CVE-2024-21131 and CVE-2024-27267 Vulnerability Details CVEID:CVE-2024-21147...

Ford wants to eavesdrop on passenger conversations to help target ads

Car manufacturer Ford Motor Company has filed a patent application for an in-vehicle advertisement presentation system based on information derived from several trip and driver characteristics. Among those characteristics—human conversations. In the abstract of the patent application publication...

[SECURITY] Fedora 40 Update: haproxy-2.9.10-1.fc40

HAProxy is a TCP/HTTP reverse proxy which is particularly suited for high availability environments. Indeed, it can: - route HTTP requests depending on statically assigned cookies - spread load among several servers while assuring server persistence through the use of HTTP cookies - switch to...

Zabbix universal monitoring system Privilege Escalation

The vulnerability of the Zabbix universal monitoring system is related to improper maintenance of permissions. Exploiting this vulnerability can allow attackers to enhance their privileges...

Duktape Unvalidated Array Indexing DoS

The vulnerability of the Duktape component in the Zabbix monitoring system is related to unvalidated array indexing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Monitoring Software Performance Co-Pilot Temporary File Permissions Insecure Symbolic Link

The vulnerability of the Performance Co-Pilot PCP monitoring and performance visualization software is related to the mixed levels of privileges used by systemd services associated with PCP. Exploiting this vulnerability allows an attacker to carry out attacks using symbolic links and to circumve...