Meta Abandons Hacking Victims, Draining Law Enforcement Resources, Officials Say

A coalition of 41 state attorneys general says Meta is failing to assist Facebook and Instagram users whose accounts have been hacked—and they want the company to take “immediate action.”...

BIT-MEDIAWIKI-2021-36129

An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggregategroup when action=remove is set, thus allowing users with the translate-manage right to silently delete various groups' metadata...

BIT-SUITECRM-2021-45041

SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resourceid and startdate...

BIT-MEDIAWIKI-2022-41766

An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyrolled message can leak a user name when the user has been revision deleted/suppressed...

BIT-RAILS-2021-44528

A open redirect vulnerability exists in Action Pack = 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website...

BIT-MATTERMOST-2023-6727

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to create playbook actions. If the playbook action created is to post a message in a channel based on specific keywords in a post, some playbook information, lik...

BIT-CONSUL-2021-36213

HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1...

The vulnerability of the sub_42AF30() function in D-Link DIR-823G router’s software allows a hacker to induce a service failure.

The vulnerability of the sub42AF30 function in D-Link DIR-823G router microprogramming software is related to errors in pointer manipulation when processing the Action parameter. Exploiting this vulnerability can allow an attacker to cause service failure...

UBUNTU-CVE-2024-26334

swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at swftools/lib/action/actioncompiler.c...

MAL-2024-1054 Malicious code in win32crypted (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a20fa9d2f01c5cc1893bbe4cfe5659f6bba9ce4dff54b741dbc46f5ded5402dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-21357 · Swftools · Swftools

Name of the Vulnerable Software and Affected Versions: swftools version 0.9.2 Description: The issue is related to a segmentation violation in the compileSWFActionCode function located at swftools/lib/action/actioncompiler.c. This function is part of the swftools library, which is used for...

CVE-2024-1936

The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. Whil...

CVE-2024-20034

In battery, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08488849; Issue ID: ALPS08488849...

openSUSE: Security Advisory for rubygem (SUSE-SU-2023:0444-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-49547

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customersupport/ajax.php?action=login...

The vulnerability of the SolarWinds Security Event Manager (SEM), previously known as SolarWinds Log & Event Manager, related to deserialization flaws, allows a hacker to execute arbitrary code.

The vulnerability of the Security Event Manager SEM, a software tool for monitoring network infrastructure formerly known as SolarWinds Log & Event Manager, is related to deficiencies in the deserialization mechanism when processing AMF Action Message Format data. Exploiting this vulnerability...

PT-2024-14929 · WordPress · The Master Slider

Name of the Vulnerable Software and Affected Versions: The Master Slider – Responsive Touch Slider plugin for WordPress versions up to, and including, 3.9.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the process bulk action...

Memory Leak

libming/libming is vulnerable to Memory Leak. The vulnerability is due to heap memory allocations on Characters and Actions within the function parseSWFDEFINEBUTTON, which are not subsequently deallocated. This allows an attacker to trigger a Denial of Service DoS through a manipulated SWF file...

Kaspersky Security Security Vulnerabilities

Kaspersky Security is a security program from the Russian laboratory Kaspersky. A security vulnerability exists in Kaspersky Security version 8.0. An attacker has exploited the vulnerability to force an administrator to click on a malicious link to perform an unauthorized action...

D-Link DIR-823G Security Vulnerability

The D-Link DIR-823G is a wireless router from China-based AUO D-Link. A security vulnerability exists in D-Link DIR-823G version A1V1.0.2B05, which originates from a buffer overflow vulnerability in the SOAPACTION parameter...