CVE-2023-42143: Improper Validation of Integrity Check Value

Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file. The device is updated with the manipulated firmware...

CVE-2023-40548

A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to a heap-based buffer overflow. This fl...

Splunk Security Breach

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Foxit PDF Editor < 11.2.8 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 11.2.8. It is, therefore affected by multiple vulnerabilities: - A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D...

openh264:decoder_fuzzer: Use-of-uninitialized-value in WelsDec::CWelsDecoder::ReorderPicturesInDisplay

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=6123830007365632 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzermsanopenh264 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

wabt:wasm_objdump_fuzzer: Use-of-uninitialized-value in wabt::BinaryReaderObjdump::PrintInitExpr

Project: https://github.com/WebAssembly/wabt.git Detailed Report: https://oss-fuzz.com/testcase?key=5958387330252800 Project: wabt Fuzzing Engine: libFuzzer Fuzz Target: wasmobjdumpfuzzer Job Type: libfuzzermsanwabt Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

PT-2024-3786

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The vulnerability is related to the Linux kernel's TCP implementation, specifically with the initialization of the accept queue's spinlocks. The issue can cause a corrupted lock value,...

Cybersecurity spend to soar in 2024: How companies can maximize their investment

"Spend smarter, not harder" is the mantra for 2024, as Gartner forecasts a 14.3% jump in global security and risk management spending—an uptick which brings a renewed focus on the need for cost-effective cybersecurity investments. Inefficient cybersecurity spending, a known problem, becomes even...

[SECURITY] Fedora 39 Update: redis-7.2.4-1.fc39

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

[SECURITY] Fedora 38 Update: redis-7.0.15-1.fc38

Redis is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets. You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing se...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the keyvalue field. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website. The injected script gets downloade...

PT-2024-1272 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.0.8 Splunk Enterprise versions prior to 9.1.3 Description: The issue is related to improper handling of permissions for users that use the REST application programming interface API in the Splunk app key...

Fedora: Security Advisory (FEDORA-2024-6ef42a28c9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for redis (FEDORA-2024-694899d442)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-29187

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential null pointer dereference in the SCP of the mtk-vcodec module has been identified. The issue arises from the failure to check the return value of devm kzalloc, which can lead ...

New TTPs observed in Mint Sandstorm campaign targeting high-profile individuals at universities and research orgs

Since November 2023, Microsoft has observed a distinct subset of Mint Sandstorm PHOSPHORUS targeting high-profile individuals working on Middle Eastern affairs at universities and research organizations in Belgium, France, Gaza, Israel, the United Kingdom, and the United States. In this campaign,...

binutils:fuzz_objcopy: Use-of-uninitialized-value in cache_bwrite

Detailed Report: https://oss-fuzz.com/testcase?key=5114458120716288 Project: binutils Fuzzing Engine: libFuzzer Fuzz Target: fuzzobjcopy Job Type: libfuzzermsanbinutils Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: cachebwrite bfdwrite coffwriterelocs...

imagemagick:encoder_dng_fuzzer: Use-of-uninitialized-value in LibRaw::parseOlympus_ImageProcessing

Detailed Report: https://oss-fuzz.com/testcase?key=5964566953525248 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderdngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

CVE-2023-0479

The Print Invoice & Delivery Notes for WooCommerce WordPress plugin before 4.7.2 is vulnerable to reflected XSS by echoing a GET value in an admin note within the WooCommerce orders page. This means that this vulnerability can be exploited for users with the editothersshoporders capability...

kernel: out-of-bounds write in qfq_change_class function

An out-of-bounds memory access flaw was found in the Linux kernel’s traffic control QoS subsystem in how a user triggers the qfqchangeclass function with an incorrect MTU value of the network device used as lmax. This flaw allows a local user to crash or potentially escalate their privileges on t...