15879 matches found
Researchers Uncover Symlink Exploit Allowing TCC Bypass in iOS and macOS
Details have emerged about a now-patched security vulnerability in Apple's iOS and macOS that, if successfully exploited, could sidestep the Transparency, Consent, and Control TCC framework and result in unauthorized access to sensitive information. The flaw, tracked as CVE-2024-44131 CVSS score:...
CVE-2024-43594
Microsoft System Center Elevation of Privilege Vulnerability...
XWiki Platform 安全漏洞
XWiki Platform is XWiki's open source suite of wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions 1.2-milestone-2 through 16.3.0, which stems from the fact that any user with a master wiki account can run scheduling operations on...
The vulnerability of the Microsoft System Center Operations Manager (SCOM) software for managing and monitoring IT services, related to access control deficiencies, allows attackers to escalate their privileges.
The vulnerability of the Microsoft System Center Operations Manager SCOM software for managing and monitoring IT services is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
INTERPOL & Trend's Fight Against Cybercrime
Trend threat intelligence and training were crucial to the success of two major policing operations in 2024...
The vulnerability of the Adobe PDFL Software Development Kit for creating, processing, and analyzing PDF documents lies in its ability to perform operations beyond the buffer boundaries in memory. This allows an attacker to execute arbitrary code.
The vulnerability of the Adobe PDFL Software Development Kit for creating, processing, and analyzing PDF documents lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
CVE-2024-43594 Microsoft System Center Elevation of Privilege Vulnerability
...
CVE-2024-43594
CVE-2024-43594 is an elevation-of-privilege vulnerability in Microsoft System Center Operations Manager (SCOM). Public references describe it as a privilege-escalation issue with a CVSSv3.1 base score of 7.3 (HIGH): attack vector Local, attack complexity Low, privileges required Low, user interac...
CVE-2024-43594 Microsoft System Center Elevation of Privilege Vulnerability
...
Improper Input Validation
Synapse is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of invites received over federation, allowing a malicious server to send crafted invites that disrupt the affected user's ability to perform /sync operations...
Microsoft System Center Operations Manager 访问控制错误漏洞
Microsoft System Center Operations Manager is a large-scale monitoring and management software for corporate environments from Microsoft USA. The software, formerly known as MOM Microsoft Operations Manager, is primarily used to monitor IT systems and provide monitoring support for distributed...
Directus allows unauthenticated access to WebSocket events and operations
Summary When setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions with full admin privileges. Details Accountability for unauthenticated WebSocket requests is set to null, which used to be "publi...
GHSA-849R-QRWJ-8RV4 Directus allows unauthenticated access to WebSocket events and operations
Summary When setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions with full admin privileges. Details Accountability for unauthenticated WebSocket requests is set to null, which used to be "publi...
CVE-2024-53143
CVE-2024-53143 affects the Linux kernel’s fsnotify path, fixing an ordering issue where iput() must complete before decrementing the watched_objects count. The patch ensures the superblock remains alive until iput() is done, preventing a potential use-after-free (UAF) of sb->s_fs_info in tmpfs...
VMware Aria Operations Multiple Vulnerabilities (VMSA-2024-0022)
The version of VMware Aria Operations running on the remote host is missing a vendor supplied patch. It is, therefore, affected by multiple vulnerabilities: - VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger...
GHSA-4GRW-M28R-Q285 rPGP Potential Resource Exhaustion when handling Untrusted Messages
During a security audit, Radically Open Security discovered two vulnerabilities which allow attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys. Impact Affected rpgp versions do not...
Wiz Defend: Delivering the Promise of Cloud-Native Security Operations
A new approach to detect and respond to cloud-native threats...
Want to Grow Vulnerability Management into Exposure Management? Start Here!
Vulnerability Management VM has long been a cornerstone of organizational cybersecurity. Nearly as old as the discipline of cybersecurity itself, it aims to help organizations identify and address potential security issues before they become serious problems. Yet, in recent years, the limitations...
Hackers Target Uyghurs and Tibetans with MOONSHINE Exploit and DarkNimbus Backdoor
A previously undocumented threat activity cluster dubbed Earth Minotaur is leveraging the MOONSHINE exploit kit and an unreported Android-cum-Windows backdoor called DarkNimbus to facilitate long-term surveillance operations targeting Tibetans and Uyghurs. "Earth Minotaur uses MOONSHINE to delive...
The vulnerability of the proc/vmcore components of the Linux operating system’s kernel allows a hacker to trigger a service failure.
The vulnerability of the proc/vmcore components in the Linux operating system’s kernel is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...