CVE-2023-3581 WebSockets accept connections from HTTPS origin

Mattermost fails to properly validate the origin of a websocket connection allowing a MITM attacker on Mattermost to access the websocket APIs...

PT-2023-25327 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue is related to Mattermost failing to properly validate the origin of a websocket connection. This allows a Man-In-The-Middle MITM attacker on Mattermost to access the websocket...

Important: Red Hat Security Advisory: .NET 6.0 security, bug fix, and enhancement update

An update for .NET 6.0 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ALSA-2023:4059 Important: .NET 6.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. The following packages have been upgraded to a later upstream version: dotnet6.0 SDK 6.0.120, Runtime 6.0.20. BZ2219639 Security Fixes: dotnet: race...

Design/Logic Flaw

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can ...

CVE-2023-35937 Metersphere missing permission check

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can ...

Silentbob Campaign: Cloud-Native Environments Under Attack

Cybersecurity researchers have unearthed an attack infrastructure that's being used as part of a "potentially massive campaign" against cloud-native environments. "This infrastructure is in early stages of testing and deployment, and is mainly consistent of an aggressive cloud worm, designed to...

CVE-2023-21637

Memory corruption in Linux while calling system configuration APIs...

Memory corruption

Memory corruption in Video while calling APIs with different instance ID than the one received in initialization...

CVE-2023-21637

CVE-2023-21637 is reported as memory corruption in Linux when system configuration APIs are called. Connected sources indicate this CVE affects Qualcomm closed‑source components and Linux environments, with multiple CVEs entries repeating the same description. No explicit root cause details, affe...

CVE-2023-21637 Improper Restrictions of Operations within the Bounds of a Memory Buffer in Linux

Memory corruption in Linux while calling system configuration APIs...

New Mockingjay Process Injection Technique Could Let Malware Evade Detection

A new process injection technique dubbed Mockingjay could be exploited by threat actors to bypass security solutions to execute malicious code on compromised systems. "The injection is executed without space allocation, setting permissions or even starting a thread," Security Joes researchers...

PT-2023-9601 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js version 20 Description: A vulnerability has been discovered in the experimental permission model of Node.js, specifically related to improper handling of Buffers in file system APIs, causing a traversal path to bypass when verifying...

CVE-2023-34156

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied...

CVE-2023-34156

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied...

CVE-2023-29531

Technical details about CVE-2023-29531 (affected product, root cause, impact, or fix) are not provided in the connected documents. Monitor for updates from Mozilla and security advisories.

CVE-2023-29531

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash. This bug only affects Firefox and Thunderbird for macOS. Other operating systems are unaffected. This vulnerability affects Firefox 112, Firefox ESR...

PT-2023-24697 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: HarmonyOS affected versions not specified Description: The issue concerns a vulnerability of services denied by early fingerprint APIs on HarmonyOS products. Successful exploitation may cause services to be denied. Recommendations: At the...

CVE-2023-34166

CVE-2023-34166 is linked to Huawei HarmonyOS in the provided documents. The Huawei/CNNVD entry describes a vulnerability in which an interface pass-in exception callback to APIs can cause a system reboot by an attacker. The NVD entry lists a CVSSv3.1 base score of 7.5 (Network, Low attack complex...

CVE-2023-34156

CVE-2023-34156 affects Huawei/HarmonyOS due to a vulnerability in the early fingerprint APIs that can cause a denial of service. The NVD entry reports a CVSS v3.1 base score of 5.3 (Network, Low attack complexity, No privileges required, Availability impact: Low). Connected sources confirm Harmon...