Friday Squid Blogging: SQUID Is a New Computational Tool for Analyzing Genomic AI

Yet another SQUID acronym: SQUID, short for Surrogate Quantitative Interpretability for Deepnets, is a computational tool created by Cold Spring Harbor Laboratory CSHL scientists. Its designed to help interpret how AI models analyze the genome. Compared with other analysis tools, SQUID is more...

kernel: ext4: avoid online resizing failures due to oversized flex bg

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbgsize, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir resize2fs $dev 16G the following WARNO...

kernel: ext4: avoid online resizing failures due to oversized flex bg

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbgsize, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir resize2fs $dev 16G the following WARNO...

CVE-2024-34607

Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34609

Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34608

Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34606

Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34609

Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34605

Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34608

The CVE-2024-34608 issue is an improper access control in PaymentManagerService prior to the SMR Aug-2024 Release 1, enabling local attackers to bypass restrictions on starting background services. Publicly noted in multiple sources, the vulnerability affects PaymentManagerService versions earlie...

CVE-2024-34604

CVE-2024-34604 involves improper access control in LedCoverService prior to SMR Aug-2024 Release 1, allowing a local attacker to bypass restrictions on starting services from the background. Affected component: LedCoverService. Root cause: access-control weaknesses enabling background-start bypas...

PT-2024-26021 · Unknown · Smartthingsservice

Name of the Vulnerable Software and Affected Versions: SmartThingsService versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper access control in SmartThingsService, allowing local attackers to bypass restrictions on starting services from the background...

PT-2024-26022 · Samsung · Samsungnotesservice

Name of the Vulnerable Software and Affected Versions: SamsungNotesService versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper access control in SamsungNotesService, allowing local attackers to bypass restrictions on starting services from the background. This...

PT-2024-26024 · Unknown · Voicenoteservice

Name of the Vulnerable Software and Affected Versions: VoiceNoteService versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper access control in the VoiceNoteService, allowing local attackers to bypass restrictions on starting services from the background...

PT-2024-26019 · Unknown · Ledcoverservice

Name of the Vulnerable Software and Affected Versions: LedCoverService versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper access control in the LedCoverService, allowing local attackers to bypass restrictions on starting services from the background...

New Windows Backdoor BITSLOTH Exploits BITS for Stealthy Communication

Cybersecurity researchers have discovered a previously undocumented Windows backdoor that leverages a built-in feature called Background Intelligent Transfer Service BITS as a command-and-control C2 mechanism. The newly identified malware strain has been codenamed BITSLOTH by Elastic Security Lab...

ASB-A-336490997

In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-17727 · Anydesk · Anydesk

Name of the Vulnerable Software and Affected Versions: AnyDesk versions prior to 9.0.1 Description: This issue allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target syst...

CVE-2024-5472 WP QuickLaTeX < 3.8.7 - Admin+ Stored XSS in Background Color field

The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5472 WP QuickLaTeX < 3.8.7 - Admin+ Stored XSS in Background Color field

The WP QuickLaTeX WordPress plugin before 3.8.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...