MAL-2024-1048 Malicious code in @apics/apps-ppp-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a11545fc54b4d0cdd2e0e8de4ab835b254677aff86d325e9bec6a0a6b5e090a8 The OpenSSF Package Analysis project identified '@apics/apps-ppp-web' @ 9.39.1 npm as malicious. It is considered malicious because: - The packa...

UBUNTU-CVE-2021-47068

In the Linux kernel, the following vulnerability has been resolved: net/nfc: fix use-after-free llcpsockbind/connect Commits 8a4cd82d "nfc: fix refcount leak in llcpsockconnect" and c33b1cc62 "nfc: fix refcount leak in llcpsockbind" fixed a refcount leak bug in bind/connect but introduced a...

CVE-2023-52488 serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO

In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: convert from raw to noinc regmap functions for FIFO The SC16IS7XX IC supports a burst mode to access the FIFOs where the initial register address is sent $00, followed by all the FIFO data without having to...

CentOS 9 : booth-1.0-251.5.bfb2f92.git.el9

The remote CentOS Linux 9 host has a package installed that is affected by a vulnerability as referenced in the booth-1.0-251.5.bfb2f92.git.el9 build changelog. - The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a...

CentOS 9 : booth-1.0-251.4.bfb2f92.git.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the booth-1.0-251.4.bfb2f92.git.el9 build changelog. - The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a...

CVE-2021-47008

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Make sure GHCB is mapped before updating Access to the GHCB is mainly in the VMGEXIT path and it is known that the GHCB will be mapped. But there are two paths where it is possible the GHCB might not be mapped. The...

Missing TTLS Encryption

github.com/edgelesssys/marblerun is vulnerable to Missing TTLS Encryption. The vulnerability is due to unsecured plain TCP connections between Marbles if the parameters don't include an environment variable. This flaw allows an attacker intercept and manipulate the communication between Marbles...

UBUNTU-CVE-2021-46924

In the Linux kernel, the following vulnerability has been resolved: NFC: st21nfca: Fix memory leak in device probe and remove 'phy-pendingskb' is alloced when device probe, but forgot to free in the error handling path and remove path, this cause memory leak as follows: unreferenced object...

Mitsubishi Electric Multiple Factory Automation Products (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Corporation Equipment : MELSEC iQ-F Series Vulnerability : Insufficient Resource Pool 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a...

MAL-2024-1034 Malicious code in fekirinetest3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d30cf456a09063b4672e17f53005e2923a34352b7e88c52f104a389cadca5c0d The OpenSSF Package Analysis project identified 'fekirinetest3' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-0220

B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data...

A New Age of Hacktivism

In the past 2 years, we have observed a significant surge in hacktivism activity due to ongoing wars and geopolitical conflicts in various regions. Since the war against Ukraine began, we have witnessed a notable mobilization of non-state and state-backed actors alike, forming new groups or joini...

CVE-2024-0220 B&R products use insufficient communication encryption

B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data...

CVE-2024-0220 B&R products use insufficient communication encryption

B&R Automation Studio Upgrade Service and B&R Technology Guarding use insufficient cryptography for communication to the upgrade and the licensing servers. A network-based attacker could exploit the vulnerability to execute arbitrary code on the products or sniff sensitive data...

Missing Encryption

github.com/cilium/cilium is vulnerable to Missing Encryption. The vulnerability is due to a lack of encryption to/from the Ingress and health endpoints when CRDs are used to store the Cilium state and Wireguard transparent encryption is enabled, which allows an attacker to eavesdrop on the...

Multiple Siemens Products Communication Channel Source Verification Error Vulnerability

The SIMATIC CP 343-1 is a communication processor CP that provides Ethernet communication for the SIMATIC S7-300 cpu. SIPLUS Extreme products are designed for reliable operation under extreme conditions and are based on SIMATIC, LOGO!, SITOP, SINAMICS, SIMOTION, SCALANCE or other devices. SIPLUS...

MAL-2024-1018 Malicious code in confusiontestt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis de074951e7ccfafea6554140dc00823f14dd665c36e60eb6d06933018831f53e The OpenSSF Package Analysis project identified 'confusiontestt' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CLSA-2024-1708094049 Fix of 8 CVEs

CVE-url: https://ubuntu.com/security/CVE-2024-23851 - dm: limit the number of targets and parameter size area CVE-url: https://ubuntu.com/security/CVE-2024-1086 - netfilter: nftables: reject QUEUE/DROP verdict parameters CVE-url: https://ubuntu.com/security/CVE-2023-35827 - ravb: Fix use-after-fr...

The vulnerability of the application programming interface of Cisco Expressway micro-programming software and Cisco TelePresence Video Communication Server micro-programming software for device management allows a attacker to perform a CSRF attack.

The vulnerability of the application programming interface of Cisco Expressway micro-programming software and Cisco TelePresence Video Communication Server micro-programming software for device management systems is related to the manipulation of cross-site requests. Exploiting this vulnerability...

The vulnerability of the Inter-Device Communication component of Cisco Firepower Threat Defense’s microprogramming software and Cisco Firepower Management Center’s network management software allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the Inter-Device Communication component of Cisco Firepower Threat Defense’s microprogramming-based network interface controllers, as well as the Cisco Firepower Management Center’s network management software, is related to improper code generation. Exploiting this...