curl: bypass of this Fixed #2437131 [ Inadequate Protocol Restriction Enforcement in curl ]

Summary: A flaw has been identified in the curl command-line tool related to its protocol selection mechanism. Specifically, the protocol restrictions set by the --proto option can be bypassed, allowing unintended protocols to be used despite explicit restrictions. This flaw can result in plainte...

Malware in rarible-program-library

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability

Velocidex WinPmem versions below 4.1 suffer from an Out of Bounds Write vulnerability. By using an IO Control, a user space program can trick the driver into writing a 0 into any chosen memory location. In conjunction with information leakage from the WinPmem driver, attackers can discover the...

The Top Cybersecurity Agency in the US Is Bracing for Donald Trump

Staffers at the Cybersecurity and Infrastructure Security Agency tell WIRED they fear the new administration will cut programs that keep the US safe—and “persecution.”...

CVE-2024-54376: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Spider Themes EazyDocs eazydocs allows PHP Local File Inclusion.This issue affects EazyDocs: from n/a through = 2.8.0...

Mattermost Mobile Apps Security Vulnerabilities

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A security vulnerability exists in Mattermost Mobile Apps version 2.21.0 and prior versions that stems from a failure to properly profile the provider program...

Malicious code in rarible-program-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ebfe242bd7c35911f61115ae2c00d485a5bb93b81ddf36f6f40af24fb1cd977 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11825 Malicious code in rarible-program-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ebfe242bd7c35911f61115ae2c00d485a5bb93b81ddf36f6f40af24fb1cd977 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GNU objdump Buffer Overflow Vulnerability

GNU objdump is a command-line program from the American GNU community for displaying various information about target files on Unix-like operating systems. A buffer overflow vulnerability exists in GNU objdump, which stems from the failure to properly validate the length of input data in the BFD...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-50162)

"The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50162 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf: devmap: provide rxq after redirect...

Wordfence Intelligence Weekly WordPress Vulnerability Report (December 2, 2024 to December 8, 2024)

Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with ourEnd of Year Holiday Extravaganza , High-Risk Bonus Blitz Challenge , and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025: All in-scope vulnerability types for...

SUSE CVE-2024-54131

The Kolide Agent aka: Launcher is the lightweight agent designed to work with Kolide's service. An implementation bug in the Kolide Agent known as launcher allows for local privilege escalation to the SYSTEM user on Windows 10 and 11. The bug was introduced in version 1.5.3 when launcher started...

kernel: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE

In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPFPROGTYPECGROUPSKB attach type enforcement in BPFLINKCREATE bpfprogattach uses attachtypetoprogtype to enforce proper attach type for BPFPROGTYPECGROUPSKB. linkcreate uses bpfprogget and relies on...

GHSA-VMQH-5232-V43R Panic in wasmvm can slow down block production

CWA-2024-008 Severity Medium Moderate + Likely^1 Affected versions: - wasmvm = 2.1.0, = 2.0.0, = 2.1.0, = 2.0.0, query wasm libwasmvm-version. It must show 1.5...

instance_create() method in the

The vulnerability of the instancecreate method in the program for monitoring and adaptive configuration of system devices related to insufficient validation of input data when processing the instancename parameter. Exploiting this vulnerability allows attackers to perform spoofing attacks...

6,000,000 WordPress Sites Protected Against Payment Refund and Subscription Cancellation Vulnerability in WPForms WordPress Plugin

💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with ourEnd of Year Holiday Extravaganza , High-Risk Bonus Blitz Challenge , and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025: All in-scope vulnerability types for...

CVE-2024-8259 Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was...

CVE-2024-54225

CVE-2024-54225: WordPress Designer plugin (CodegearThemes Designer) contains a PHP Local File Inclusion due to improper filename control in include/require. Affected versions: Designer <= 1.3.3 (per NVD) with Wordfence listing Designer

MAL-2024-11426 Malicious code in programupdater (npm)

--- -= Per source details. Do not edit below this line.=-...

Eryaz NatraCar B2B Dealer Management Program has a security vulnerability

Eryaz NatraCar B2B Dealer Management Program is a dealer management system from Eryaz. A security vulnerability exists in Eryaz NatraCar B2B Dealer Management Program that stems from improper use of special elements in SQL commands, resulting in a SQL injection vulnerability...