Critical Exim Mail Server Vulnerability Exposes Millions to Malicious Attachments

A critical security issue has been disclosed in the Exim mail transfer agent that could enable threat actors to deliver malicious attachments to target users' inboxes. The vulnerability, tracked as CVE-2024-39929, has a CVSS score of 9.1 out of 10.0. It has been addressed in version 4.98. "Exim...

CVE-2024-3325

Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0...

CVE-2024-3325

Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0...

CVE-2024-3325

Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0...

CVE-2024-3325 JasperReports Server Driver upload vulnerability

Vulnerability in Jaspersoft JasperReport Servers.This issue affects JasperReport Servers: from 8.0.4 through 9.0.0...

CVE-2024-3325

Jaspersoft JasperReports Server CVE-2024-3325 affects version 8.0.4 through 9.0.0. Root cause: a JDBC driver upload feature is not properly guarded by configuration, leaving the server susceptible if the administrator does not enable the safety control. The vulnerability description in the connec...

PT-2024-25168 · Jaspersoft · Jasperreports Server

Name of the Vulnerable Software and Affected Versions: Jaspersoft JasperReport Servers versions 8.0.4 through 9.0.0 Description: The issue affects Jaspersoft JasperReport Servers, causing a vulnerability. No information is provided about the estimated number of potentially affected devices...

PT-2024-6122 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: InPost for WooCommerce plugin versions 1.4.0 and earlier InPost PL plugin for WordPress versions 1.4.4 and earlier Description: The issue is related to a missing capability check on the parse request function, allowing unauthorized access and...

Exploit for Race Condition in Openbsd Openssh

CVE-2024-6387 Vulnerability Checker Overview This Python...

CVE-2023-50178

FortiADC is affected by an improper certificate validation vulnerability (CWE-295) that may allow remote, unauthenticated attackers to perform a Man-in-the-Middle on the channel between FortiADC devices and remote servers (e.g., private SDN connectors, FortiToken Cloud). Connected sources consist...

CVE-2024-22020

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports...

CVE-2024-22020

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports...

CVE-2024-22020

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports...

CVE-2024-22020

CVE-2024-22020 (Node.js) is a real vulnerability affecting Node.js where an attacker can bypass network import restrictions by embedding non-network imports in data URLs, enabling arbitrary code execution. The issue is documented across multiple advisories (e.g., Debian DSA, CBLMariner, AlmaLinux...

CVE-2024-22020

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports...

Microsoft Windows Workstation Security Vulnerability

Microsoft Windows Workstation is an application from Microsoft USA. Handles advanced workloads with the help of server-level data protection and performance. Microsoft Windows Workstation has a security vulnerability. An attacker exploiting the vulnerability can elevate privileges. The following...

CloudSorcerer – A new APT targeting Russian government entities

In May 2024, we discovered a new advanced persistent threat APT targeting Russian government entities that we dubbed CloudSorcerer. Its a sophisticated cyberespionage tool used for stealth monitoring, data collection, and exfiltration via Microsoft Graph, Yandex Cloud, and Dropbox cloud...

Server-Side Request Forgery

github.com/go-skynet/localai is vulnerable to Server-Side Request Forgery. The vulnerability is due to the /models/apply endpoint supporting both https:// and file:// schemes, which can lead to LFI. The attacker can exploit this vulnerability with network access to the LocalAI instance, potential...

CVE-2024-6387: New OpenSSH RegreSSHion Vulnerability Gives Hackers Root Access on Linux Servers – 700,000+ Linux Boxes Potentially at Risk

Labeled as CVE-2024-6387, the recently discovered vulnerability in OpenSSH has become a serious cause for concern among Linux servers. OpenSSH is a collection of networking tools built on the Secure Shell SSH protocol. It is widely utilized to secure remote logins, manage and administer remote...

CVE-2024-6095 SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https:// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the...