The vulnerability of the Intel Memory and Storage Tool’s software for monitoring and managing RAM and solid-state drives allows a hacker to exploit their privileges. This vulnerability arises due to the situation where the tool accesses an alternative channel, enabling the hacker to circumvent the security measures.

The vulnerability of the Intel Memory and Storage Tool software for monitoring and managing RAM and solid-state drives is related to the situation of competing when accessing an alternative channel. Exploiting this vulnerability can allow a hacker to enhance their privileges...

CVE-2024-24259

A memory leak flaw was found in the glutAddMenuEntry function of freeglut, an open-source alternative to the OpenGL Utility Toolkit. This issue may allow an attacker to launch a denial of service attack by crashing or hanging the program or take advantage of other unexpected program behavior...

RUSTSEC-2024-0014 `generational-arena` is unmaintained

The generational-arena crate's repository has been archived and is no longer maintained. Alternatives - slotmap...

Hardcoded credentials

pkg is tool design to bundle Node.js projects into an executables. Any native code packages built by pkg are written to a hardcoded directory. On unix systems, this is /tmp/pkg/ which is a shared directory for all users on the same local system. There is no uniqueness to the package names within...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to bypassing the authentication process by using an alternative path or channel, allows a hacker to execute arbitrary code.

The vulnerability of the Continuous Integration and Application Delivery system CI/CD of TeamCity in JetBrains is related to the ability to bypass the authentication process by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

State of Malware 2024: What consumers need to know

Released today, the Malwarebytes State of Malware 2024 report takes a deep dive into the latest developments in the world of cybercrime. As home users, many of the threats we cover will only affect you second hand, such as disruptions after a company suffers a ransomware attack, or when your...

avahi: Reachable assertion in avahi_alternative_host_name

A vulnerability was found in Avahi. A reachable assertion exists in the avahialternativehostname function...

`conrod_core` is unmaintained

The conrodcore crate is no longer maintained. The author suggests egui as a potential alternative...

RUSTSEC-2024-0396 `conrod_core` is unmaintained

The conrodcore crate is no longer maintained. The author suggests egui as a potential alternative...

avahi: Reachable assertion in avahi_alternative_host_name

A vulnerability was found in Avahi. A reachable assertion exists in the avahialternativehostname function...

curl: FTP too eager connection reuse

A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic...

Medium: rust

Issue Overview: Cargo downloads a Rust project's dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject...

ADCSync - Use ESC1 To Perform A Makeshift DCSync And Dump Hashes

This is a tool I whipped up together quickly to DCSync utilizing ESC1. It is quite slow but otherwise an effective means of performing a makeshift DCSync attack without utilizing DRSUAPI or Volume Shadow Copy. This is the first version of the tool and essentially just automates the process of...

WordPress Seraphinite Alternative Slugs Manager Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Seraphinite Alternative Slugs Manager Type Plugin Vulnerable versions = 1.3 Fixed in 1.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 55144db568c7 Credits WordFence...

Mobile malware analysis for the BBC

This is a version of our report referenced in the Helping a mobile malware fraud victim blog post, with all sensitive information removed. Summary One malicious application was identified on the device, and evidence identified during the examination strong suggests though this cannot be confirmed...

Carbanak Banking Malware Resurfaces with New Ransomware Tactics

The banking malware known as Carbanak has been observed being used in ransomware attacks with updated tactics. "The malware has adapted to incorporate attack vendors and techniques to diversify its effectiveness," cybersecurity firm NCC Group said in an analysis of ransomware attacks that took...

avahi: Reachable assertion in avahi_alternative_host_name

A vulnerability was found in Avahi. A reachable assertion exists in the avahialternativehostname function...

java-21-openjdk security and bug fix update

1:21.0.1.0.12-2.0.1 - Add Oracle vendor bug URL 1:21.0.1.0.12-2 - Switch to using portable binaries built on RHEL 7 - Sync the copy of the portable specfile with the RHEL 7 version - Related: RHEL-12997 1:21.0.1.0.12-1 - Update to jdk-21.0.1.0+12 GA - Update release notes to 21.0.1.0+12 - Sync th...

PT-2023-36097 · Python · Cpython

Name of the Vulnerable Software and Affected Versions: cpython affected versions not specified python3-sys affected versions not specified python27-sys affected versions not specified Description: The issue concerns the cpython crate and its underlying crates, python3-sys and python27-sys, which...

java-21-openjdk security and bug fix update

1:21.0.1.0.12-2.0.1 - Add Oracle vendor bug URL 1:21.0.1.0.12-2 - Switch to using portable binaries built on RHEL 7 - Sync the copy of the portable specfile with the RHEL 7 version - Related: RHEL-12997 1:21.0.1.0.12-1 - Update to jdk-21.0.1.0+12 GA - Update release notes to 21.0.1.0+12 - Sync th...