CVE-2024-49764: Improper Neutralization of Input During Web Page Generation

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This...

LibreNMS cross-site scripting vulnerabilities

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS that stems from a stored...

SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav

Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave. Description The...

Double-free in libpcap before 1.10.5 with remote packet capture support.

...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.0), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.0) +1 more potentially affected by CVE-2024-52007 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.0 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.6.0...

Malicious code in pupeteer-capture (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 021121bee5e4389860a59c8fe51ff445ba8a266672fc246bdb5eff63d96d1c5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10517 Malicious code in pupeteer-capture (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 021121bee5e4389860a59c8fe51ff445ba8a266672fc246bdb5eff63d96d1c5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in pupeteer-capture

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

New Stealer Uses Invalid Cert To Compromise Systems

New Stealer Uses Invalid Cert To Compromise Systems By Mohinder Gill, Mallikarjun Wali and Sangram Mohapatro · November 07, 2024 A new Stealer has been making the rounds. Its name: Fickle. Fickle Stealer is a new Rust-based information stealer that spreads through various attack vectors, includin...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.6.0), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.6.0) +1 more potentially affected by CVE-2024-51132 via ca.uhn.hapi.fhir:org.hl7.fhir.r4 (5.6.0)

ca.uhn.hapi.fhir:org.hl7.fhir.r4 MAVEN version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r4 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.6.0 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.6.0...

CBL Mariner 2.0 Security Update: libpcap / nmap (CVE-2024-8006)

The version of libpcap / nmap installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8006 advisory. - Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remo...

NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support

...

Advisory ROSA-SA-2024-2509

Software: freeradius 3.0.13 OS: rosa-server79 packageevrstring: freeradius-3.0.13-15.0.1.res7 CVE-ID: CVE-2024-3596 BDU-ID: 2024-05180 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the RADIUS authentication protocol implementation is related to bypassing the authentication procedure through...

CVE-2024-22066: Authentication Bypass by Capture-replay

There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the vulnerability to obtain sensitive information about the device...

PT-2024-34112

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A buffer overwrite issue has been resolved in the Linux kernel. The problem occurred when using more than 32 buffers in the video capture queue, causing an out-of-bounds write. This...

New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT

Cybersecurity researchers have disclosed a new malware campaign that leverages a malware loader named PureCrypter to deliver a commodity remote access trojan RAT called DarkVision RAT. The activity, observed by Zscaler ThreatLabz in July 2024, involves a multi-stage process to deliver the RAT...

CVE-2024-8912

An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: Looker Google Cloud core was found to be vulnerable. This issue has already been mitigated and our...

SUSE CVE-2024-9781

AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file...

Wireshark Security Update (wnpa-sec-2024-13) - Mac OS X

Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...

CVE-2024-8912: Inconsistent Interpretation of HTTP Requests

An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: Looker Google Cloud core was found to be vulnerable. This issue has already been mitigated and our...