Oracle Linux 8 : istio (ELSA-2023-12780)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12780 advisory. - Addresses CVE CVE-2023-35941, CVE-2023-35942, CVE-2023-35943, CVE-2023-35944. olcne - CVE-2023-35941 - CVE-2023-35942 - CVE-2023-35943 Tenable has...

Amazon Linux 2 : ecs-service-connect-agent (ALASECS-2023-006)

The version of ecs-service-connect-agent installed on the remote host is prior to v1.26.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2023-006 advisory. Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to...

Citrix DaaS - The Published resource is not available currently. try again later

After migrating from on premise to Citrix Cloud, users facing issues when launching apps via DaaS only via native CWA. Launching via web browser works as expected. Users are getting error: Transaction ID: xxxxxxxxxxxxxxxxx The resource is not available at the moment. Please try again later. Issue...

DiDi Know Streaming Security Breach

DiDi Know Streaming is a cloud-native Kafka management platform from China-based DiDi. A security vulnerability exists in DiDi Know Streaming that stems from an elevation of privilege vulnerability...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update

Red Hat JBoss Web Server 5.7.4 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CV...

PT-2023-13811 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem affected versions not specified Description: The issue is related to memory corruption due to a buffer over-read in the Modem while processing the SetNativeHandle RTP service. This can potentially lead to security risks. The estimated...

Remote Command Execution Vulnerability in NC Cloud of UFIDA Network Technology Co.

NC Cloud is a large-scale enterprise digital platform that deeply applies new-generation digital intelligence technology and is completely based on cloud-native architecture to create an open, interconnected, converged and intelligent integrated cloud platform. A remote command execution...

Oracle Java SE Multiple Vulnerabilities (July 2022 CPU update) CVE-2022-21540 CVE-2022-21541 CVE-2022-21549 CVE-2022-25647 CVE-2022-34169

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2022 CPU advisory: - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot...

A Bootiful Podcast: cloud native Chris Richardson

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to original cloud native Chris Richardson on microservices, architecture, and more...

Update now! WinRAR files can be abused to run malware

A new version of the file archiving software WinRAR fixes two vulnerabilities that could allow an attacker to execute code on a target system. All the victim has to do is to open a specially crafted archive. After receiving a report about the vulnerability in June, a new version of the software w...

Malicious code in stripe-identity-react-native-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb5d2bc0139deaa57cabe88a2bee12171f6b1348c6a8ae5227efd82ec4a556af The OpenSSF Package Analysis project identified 'stripe-identity-react-native-example' @ 1.0.0 npm as malicious. It is considered malicious...

MAL-2023-1535 Malicious code in stripe-identity-react-native-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb5d2bc0139deaa57cabe88a2bee12171f6b1348c6a8ae5227efd82ec4a556af The OpenSSF Package Analysis project identified 'stripe-identity-react-native-example' @ 1.0.0 npm as malicious. It is considered malicious...

CVE-2023-4265 Buffer overflow in Zephyr USB

Potential buffer overflow vulnerabilities in the following locations: https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usbdcnativeposix.cL359 https://github.com/zephyrproject-rtos/zephyr/blob/main/drivers/usb/device/usbdcnativeposix.cL359...

Emerging Attacker Exploit: Microsoft Cross-Tenant Synchronization

Attackers continue to target Microsoft identities to gain access to connected Microsoft applications and federated SaaS applications. Additionally, attackers continue to progress their attacks in these environments, not by exploiting vulnerabilities, but by abusing native Microsoft functionality ...

Malicious code in react-native-transparent-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfc4c56c3c11c9b9f70d9cc95f941b8549be2b5b18c367c51ed8d531cb0f2ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in react-native-transparent-video

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-1441 Malicious code in react-native-transparent-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfc4c56c3c11c9b9f70d9cc95f941b8549be2b5b18c367c51ed8d531cb0f2ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LendingLedger Lack of method to rescue accidentally sent Canto

Lines of code Vulnerability details Impact There is no function to rescue Canto accidentally sent to LendingLedger so if governance fat-finger those Canto could be lost forever. Proof of Concept There is no function to transfer native token out of LendingLedger Tools Used Manual inspection...

check for the reentrancy attack is missed in the claim function

Lines of code Vulnerability details Impact the function claim in the LendingLedger.sol will send native token $CANTO to the msg.sender by .call which it can be EOA or Contracts, because there is no any RA checks the caller can make double call in the same time to get himself more tokens reward th...

Calc token amount can be manipulated

Lines of code Vulnerability details Impact function calcDepositInOneCoin uint2563 memory arr private view returns uint256 return liquidityPool.calctokenamountarr, true; This function is being used to calculate slippage, return value calctokenamount can be manipulated as described in POC section,...