GHSA-F5X2-XV93-4P23 Access of Resource Using Incompatible Type in Facebook Hermes

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

Access of Resource Using Incompatible Type in Facebook Hermes

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

The Fault in Our Kubelets: Analyzing the Security of Publicly Exposed Kubernetes Clusters

While researching cloud-native tools, our Shodan scan revealed over 200,000 publicly exposed Kubernetes clusters and kubelet ports that can be abused by criminals...

CVE-2020-1914

A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable i...

3 Recommendations to Ensure Your API Security Solution can Drive Data Visibility and Quality

Today at least 90% of developers are using APIs in cloud-native web application development. According to new data collected by Forrester Research and presented in their report, Improve API Performance with a Sound API Security Strategy, 62 percent of IT decision makers believe the value they gai...

Microsoft DWM Core Library Elevation of Privilege Vulnerability (CNVD-2022-45485)

Microsoft DWM Core Library is the United States Microsoft Microsoft company's Microsoft windows get a core library. An elevation of privilege vulnerability exists in the Microsoft DWM Core Library. The vulnerability arises from an incorrect programmatic call to a high-level native procedure. An...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.4 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.3 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.5 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps security update

An update is now available for Red Hat OpenShift GitOps 1.3 in openshift-gitops-argocd container. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

PT-2024-11784

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference issue has been resolved in the Linux kernel. The issue occurs in the radeon fp native mode function, where the return value of drm mode duplicate is assigned t...

Security Bulletin: OpenSSL (Publicly disclosed vulnerability)

Summary IBM MobileFirst Platform Foundation has addressed the following vulnerability by updating the version of OpenSSL. Vulnerability Details CVEID:CVE-2021-4160 DESCRIPTION: OpenSSL could provide weaker than expected security, caused by a carry propagation flaw in the MIPS32 and MIPS64 squarin...

Apple tvOS race condition bug

Apple tvOS is a smart TV operating system from Apple, Inc. Apple tvOS versions 15.0 19J346 - 15.4.1 19L452 contain a Competitive Condition Issue vulnerability that stems from a contention condition in IOKit. An attacker could exploit the vulnerability to elevate privileges on the system via a...

Apple macOS Monterey: Permissions and access control issues

Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. Apple macOS Monterey versions 12.0 21A344 - 12.3.1 21E258 have a privilege-granting and access-control issue vulnerability that stems from a plug-in that may be able to inherit an...

Apple tvOS Buffer Error Vulnerability

Apple tvOS is a smart TV operating system from Apple, Inc. A buffer error vulnerability exists in Apple tvOS versions 15.0 19J346 - 15.4.1 19L452, which stems from a boundary error in the operating system kernel subsystem. An attacker exploiting this vulnerability could elevate privileges on the...

Withdrawing ETH collateral with max uint256 amount value reverts transaction

Lines of code Vulnerability details Impact Withdrawing ETH collateral via the withdrawCollateral function using typeuint256.max for the amount parameter reverts the transaction due to asset being the zero-address and IERC20Detailedasset.decimals not working for native ETH. Proof of Concept...

org.apache.activemq.examples.broker:artemis-cdi-example (1.5.3), org.apache.activemq.examples.broker:bridge (1.5.3) +57 more potentially affected by CVE-2017-12174 via org.apache.activemq:artemis-native (1.5.3)

org.apache.activemq:artemis-native MAVEN version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-native and may be impacted: - org.apache.activemq.examples.broker:artemis-cdi-example 1.5.3 -...

org.apache.activemq.examples.amqp:protoncpp (1.1.0), org.apache.activemq.examples.broker:auto-closeable (1.1.0) +116 more potentially affected by CVE-2017-12174 via org.apache.activemq:artemis-native (1.1.0)

org.apache.activemq:artemis-native MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-native and may be impacted: - org.apache.activemq.examples.amqp:protoncpp 1.1.0 -...

org.apache.activemq.examples.broker:artemis-cdi-example (1.5.4), org.apache.activemq.examples.broker:bridge (1.5.4) +62 more potentially affected by CVE-2017-12174 via org.apache.activemq:artemis-native (1.5.4)

org.apache.activemq:artemis-native MAVEN version 1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-native and may be impacted: - org.apache.activemq.examples.broker:artemis-cdi-example 1.5.4 -...

org.apache.activemq.examples.broker:artemis-cdi-example (1.5.2), org.apache.activemq.examples.broker:bridge (1.5.2) +57 more potentially affected by CVE-2017-12174 via org.apache.activemq:artemis-native (1.5.2)

org.apache.activemq:artemis-native MAVEN version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:artemis-native and may be impacted: - org.apache.activemq.examples.broker:artemis-cdi-example 1.5.2 -...