CVE-2024-40618

CVE-2024-40618 affects Whale Browser prior to 3.26.244.21. The issue stems from improper sanitization when processing a built-in extension, enabling an attacker to execute malicious JavaScript. Impact: high confidentiality/integrity exposure with network access required. Remediation: update to ve...

CVE-2024-40618

Whale browser before 3.26.244.21 allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension...

[SECURITY] Fedora 40 Update: onnx-1.14.1-3.fc40

onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...

PT-2024-28945 · Unknown · Whale Browser

Name of the Vulnerable Software and Affected Versions: Whale browser versions prior to 3.26.244.21 Description: The issue allows an attacker to execute malicious JavaScript due to improper sanitization when processing a built-in extension. Recommendations: For versions prior to 3.26.244.21, updat...

Naver Whale Browser Security Vulnerability

Naver Whale Browser is a web browser from Naver, a South Korean company that supports user-defined interfaces. A security vulnerability exists in Naver Whale Browser versions prior to 3.26.244.21, which stems from improper cleanup when dealing with built-in extensions, allowing an attacker to...

AZL-43288 CVE-2024-39484 affecting package kernel for versions less than 5.15.162.2-1

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driver is builtin Using exit for the remove function results in the remove callback being discarded with CONFIGMMCDAVINCI=y. When such a device gets unbound e.g. using sysfs or...

libreoffice: create a document which without prompt will execute scripts built-into LibreOffice on clicking a graphic

A flaw was found in LibreOffice. Unchecked script execution in graphic on-click binding allows an attacker to create a document, which, without a prompt, will execute scripts built into LibreOffice when clicking a graphic. These scripts were previously deemed trusted but are now deemed untrusted...

Yokogawa FAST/TOOLS and CI Server

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION : Exploitable remotely/low attack complexity Vendor : Yokogawa Equipment : FAST/TOOLS and CI Server Vulnerabilities : Cross-site Scripting, Empty Password in Configuration File 2. RISK EVALUATION Successful exploitation of these vulnerabilities...

Astra Linux – Vulnerability in Firefox

A website was able to detect when a user took a screenshot of a page using the built-in Screenshot functionality in Firefox. This vulnerability affects Firefox versions less than 127...

CVE-2024-4106

A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as...

CVE-2024-4106

A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as...

CVE-2024-4106

A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as...

CVE-2024-4106

Summary (CVE-2024-4106) Yokogawa FAST/TOOLS and CI Server are affected by an authentication issue due to built-in accounts with no passwords. Affected versions: FAST/TOOLS R9.01–R10.04 (Packages RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) and CI Server R1.01.00–R1.03.00. The CISA/ICS advisory details ...

Yokogawa FAST/TOOLS Security Breach

Yokogawa FAST/TOOLS is a real-time operations management and visualization software from Yokogawa Electric Yokogawa Corporation, Japan. A security vulnerability exists in Yokogawa FAST/TOOLS versions R9.01 through R10.04, and Collaborative Information Server versions R1.01.00 through R1.03.00,...

SUSE CVE-2024-38605

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix NULL module pointer assignment at card init The commit 81033c6b584b "ALSA: core: Warn on empty module" introduced a WARNON for a NULL module pointer passed at sndcard object creation, and it also wraps the code...

The vulnerability of D-Link’s wireless router microprogramming software lies in the presence of undocumented configuration commands. This allows a hacker to enable the Telnet service by accessing a specially crafted URL address and logging into the system using the built-in credentials.

The vulnerability of D-Link wireless router microprogramming software is related to the presence of undocumented configuration commands. Exploiting this vulnerability allows a malicious actor to enable the Telnet service by accessing a specially crafted URL address, and then gain access to the...

Observable Timing Discrepancy

Overview Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the handling of RSA premaster secrets when an invalid secret is received. An attacker can potentially observe timing differences by exploiting the additional processing performed when the premaster...

Ubuntu 20.04 LTS / 22.04 LTS : QEMU regression (USN-6567-2)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6567-2 advisory. USN-6567-1 fixed vulnerabilities QEMU. The fix for CVE-2023-2861 was too restrictive and introduced a behaviour change leading to a regression in...

RHEL 7 : bash (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - bash: when effective UID is not equal to its real UID the saved UID is not dropped CVE-2019-18276 - A...

The vulnerability in the built-in HTTP server of the Fluent Bit logging and processing tool allows a perpetrator to execute arbitrary code.

The vulnerability of the built-in HTTP server tool for logging and processing logs in Fluent Bit is related to the possibility of buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...