CVE-2024-31415

The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encrypti...

CVE-2024-31415

The CVE-2024-31415 issue affects Eaton Foreseer EPMS software. The root cause is insecurely stored encryption keys used to protect server configuration data, allowing an attacker with local access to potentially change or remove external server configurations. Public documents describe the vulner...

PT-2024-31435 · Lenovo · Lenovo Thinksystem Servers

Name of the Vulnerable Software and Affected Versions: Lenovo ThinkSystem servers affected versions not specified Description: An internal product security audit discovered a UEFI SMM System Management Mode callout issue in certain ThinkSystem servers. This could allow a local attacker with...

HPESBHF04701 rev.2 - Certain HPE ProLiant DL/ML/XL, Alletra, Synergy, and Edgeline Servers Using Certain Intel Processors, INTEL-SA-01097, 2024.3 IPU - Intel Processor Advisory, Local Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL110 Gen10 Plus Telco server - Prior to v2.2008-07-2024 HPE ProLiant DL360 Gen10 Plus server - Prior to v2.2008-07-2024 HPE ProLiant DL380 Gen10 Plus server - Prio...

HPESBHF04702 rev.2 - Certain HPE ProLiant DL/ML/XL, Alletra, Synergy, and Edgeline Servers Using Certain Intel Processors, INTEL-SA-01103, 2024.3 IPU - Intel Processor RAPL Interface Advisory, Local Disclosure of Information Vulnerability

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL110 Gen10 Plus Telco server - Prior to v2.2008-07-2024 HPE ProLiant DL360 Gen10 Plus server - Prior to v2.2008-07-2024 HPE ProLiant DL380 Gen10 Plus server -...

Chinese DragonRank Hackers Exploit Global Windows Servers in SEO Fraud

DragonRank, a Chinese-speaking hacking group, has compromised 30+ Windows servers globally. They exploit IIS vulnerabilities to manipulate SEO…...

DragonRank Black Hat SEO Campaign Targeting IIS Servers Across Asia and Europe

A "simplified Chinese-speaking actor" has been linked to a new campaign that has targeted multiple countries in Asia and Europe with the end goal of performing search engine optimization SEO rank manipulation. The black hat SEO cluster has been codenamed DragonRank by Cisco Talos, with victimolog...

The vulnerability of the BIOS microprogramming software in Dell PowerEdge servers allows a hacker to disclose protected information.

The vulnerability of Dell PowerEdge server BIOS microprogramming software relates to writing data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the BIOS microprogramming software in Dell PowerEdge servers allows a hacker to disclose protected information.

The vulnerability of the BIOS microprogramming software in Dell PowerEdge servers is related to insufficient validation of input data. Exploiting this vulnerability can allow attackers to disclose protected information...

DragonRank, a Chinese-speaking SEO manipulator service provider

Key Takeaways Cisco Talos is disclosing a new threat called "DragonRank" that primarily targets countries in Asia and a few in Europe, operating PlugX and BadIIS for search engine optimization SEO rank manipulation. DragonRank exploits targets' web application services to deploy a web shell and...

NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities: - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPTFOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow...

Microsoft KernelStream 安全漏洞

Microsoft KernelStream is a service from Microsoft Corporation USA for supporting streaming data in the kernel. A security vulnerability exists in Microsoft KernelStream. An attacker could exploit the vulnerability to elevate privileges. The following products and editions are affected:Windows 10...

Server-Side Request Forgery in federated sharing API - ownCloud

Server-Side Request Forgery in federated sharing API may allow an unauthenticated attacker to identify internal servers. Furthermore, due to improper timeout handling, the server could be affected by a Denial of Service attack...

HTTP Request/Response Smuggling

com.typesafe.akka:akka-http-core is vulnerable to HTTP Request/Response Smuggling. The vulnerability is due to accepting malformed messages and handing them over to the user application, which may proxy them to another server without inspection, allowing unintended HTTP requests to reach downstre...

CVE-2024-6119 Possible denial of service in X.509 name checks

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119 Possible denial of service in X.509 name checks

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

CVE-2024-6119

OpenSSL CVE-2024-6119 causes a denial of service when applications perform certificate name checks (e.g., TLS server name validation). The issue stems from reading an invalid memory address during name comparison (e.g., otherName in X.509) and may terminate the process. Multiple connected advisor...

CVE-2024-6119

Issue summary: Applications performing certificate name checks e.g., TLS clients checking server certificates may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of...

golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm

A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to...