CVE-2023-32190

A flaw was found in the mlocate package of OpenSUSE and derived distributions. This issue occurs due to a insecure chmod call in the %post section of the mlocate package, allowing users to obtain read/write access to arbitrary files on the system when the mlocate package is re-installed or upgrad...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Storage Protect Operations Center.

Summary IBM Storage Protect Operations Center may be impacted by multiple vulnerabilities CVE-2024-21147, CVE-2024-21145, CVE-2024-21140, CVE-2024-21144, CVE-2024-21138, CVE-2024-21131, CVE-2024-27267 in the IBM® SDK Java™ Technology Edition, Version 8, potentially leading to a loss of...

MAL-2024-9888 Malicious code in typescript-operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2544cf70949cf6d816efcf9c404b10284f71d0a8fb80f6c46ae0c8aa9b7842d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in typescript-operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2544cf70949cf6d816efcf9c404b10284f71d0a8fb80f6c46ae0c8aa9b7842d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Simplify Security and Enhance WAAP with Detection and Control in the AI Era

Simplify operations without sacrificing control. Read how Akamai delivers a robust defense with innovations like Behavioral DDoS Engine and AI Assistant...

Malicious code in gql-tag-operations (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9646 Malicious code in gql-tag-operations (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-32190

mlocate's %post script allows RUNUPDATEDBAS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges...

CVE-2023-32190 mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable

mlocate's %post script allows RUNUPDATEDBAS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges...

CVE-2023-32190

CVE-2023-32190 affects the mlocate package (notably OpenSUSE-derived distributions). The vulnerability stems from an insecure chmod/permissions handling in the %post script, allowing a local attacker to abuse root-run file operations to make arbitrary files world-readable. Impact is localized to ...

CVE-2023-32190

Removed by vendor...

Security Bulletin: Denial of service in IBM WebSphere Application Server Liberty may affect IBM Storage Protect Operations Center (CVE-2024-25026).

Summary IBM Storage Protect Operations Center may be affected by denial of service caused by specially crafted request in IBM WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2024-25026 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Serve...

PT-2024-12299 · Mlocate · Mlocate

Name of the Vulnerable Software and Affected Versions: mlocate affected versions not specified Description: The issue allows the RUN UPDATEDB AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges. This is due to mlocate's %post script...

openSUSE Tumbleweed 安全漏洞

openSUSE Tumbleweed is an open source system from SUSE Germany. A security vulnerability exists in openSUSE Tumbleweed that originates from allowing a user to make arbitrary files readable by everyone by abusing insecure file operations run with root privileges...

The vulnerability of the Windows Mobile Broadband Driver allows a hacker to execute arbitrary code.

The vulnerability of the Windows Mobile Broadband Driver for Windows operating systems is related to the execution of operations beyond the buffer in memory, due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

China Accuses U.S. of Fabricating Volt Typhoon to Hide Its Own Hacking Campaigns

China's National Computer Virus Emergency Response Center CVERC has doubled down on claims that the threat actor known as Volt Typhoon is a fabrication of the U.S. and its allies. The agency, in collaboration with the National Engineering Laboratory for Computer Virus Prevention Technology, went ...

USN-7066-1: Thunderbird vulnerability

Damien Schaeffer discovered that Thunderbird did not properly manage certain memory operations when processing content in the Animation timelines. An attacker could potentially exploit this issue to achieve arbitrary code execution...

Ubuntu 20.04 LTS / 22.04 LTS : Thunderbird vulnerability (USN-7066-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7066-1 advisory. Damien Schaeffer discovered that Thunderbird did not properly manage certain memory operations when processing content in the Animation timelines. An...

The vulnerability of the Storage Port Driver driver for Windows operating systems, which allows attackers to increase their privileges

The vulnerability of the Storage Port Driver driver for Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

OESA-2024-2236 xterm security update

The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals. Security Fixes: xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the...