PT-2024-1655 · Cisco · Cisco Telepresence Video Communication Server +1

Name of the Vulnerable Software and Affected Versions: Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS affected versions not specified Description: The issue concerns multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Serve...

CVE-2024-22388

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

Design/Logic Flaw

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

CVE-2024-22388 Insecure Default Initialization of Resource in HID Global

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

CVE-2024-22388

CVE-2024-22388 affects HID Global devices configured as encoders (e.g., iCLASS SE CP1000 Encoder, iCLASS SE Readers/Modules/Processors, OMNIKEY 5427CK/5127CK/5023/5027). Root cause: improper authorization in the encoder communication channel enables exposure of sensitive data when reader configur...

CVE-2024-22388 Insecure Default Initialization of Resource in HID Global

Certain configuration available in the communication channel for encoders could expose sensitive data when reader configuration cards are programmed. This data could include credential and device administration keys...

CVE-2023-40544

An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications...

MAL-2024-967 Malicious code in @ssr-frontend/packages-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17a895de36109204be95b9aba4154cc6414897889ce21aed3bfa4f0a304b3453 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability in the implementation of the WebRTC technology in Google Chrome and Microsoft Edge browsers allows a hacker to execute arbitrary code.

The vulnerability of WebRTC implementations in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2024-41456 · Gnu +2 · Linux +2

Уязвимость функции tipc udp nl dump remoteip в модуле net/tipc/udp media.c реализации протокола TIPC Transparent Inter Process Communication ядра операционной системы Linux связана с некорректной валидацией полученных данных. Эксплуатация уязвимости может позволить нарушителю получить доступ к...

CVE-2024-0323

The CVE-2024-0323 entry affects the B&R Automation Runtime FTP server, where the FTP service supports insecure encryption mechanisms (SSLv3, TLS 1.0, TLS 1.1). Affected product: B&R Automation Runtime (FTP server). Documented impact: network-based attacker can perform man-in-the-middle attacks or...

Symphony Communication ServicesHp Symphony Security Vulnerability

Symphony Communication ServicesHp Symphony is a solution from Symphony Communication ServicesHp, Inc. for connecting and liquefying financial transaction workflows. A security vulnerability exists in Symphony Communication ServicesHp Symphony v.3.6.3 and earlier versions, which originates from a...

MAL-2024-961 Malicious code in cifuzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7377471f095cc9fc80601acc697c994417df898d009b1cb5fa4c14ca198ae15 The OpenSSF Package Analysis project identified 'cifuzz' @ 1.2.0 npm as malicious. It is considered malicious because: - The package communicate...

Malicious code in discord.js-commandsv14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0552b95113f728a401629d22107eae7aa9479e0632b876f49e2558af8784f665 The OpenSSF Package Analysis project identified 'discord.js-commandsv14' @ 1.0.4 npm as malicious. It is considered malicious because: - The...

SUSE SLES15: libnss_slurm2 / libpmi0 / libslurm36 / perl-slurm / slurm / etc (SUSE-SU-2024:0314-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0314-1 advisory. Security fixes: - CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove...

SUSE SLES12: libpmi0 / libslurm31 / perl-slurm / slurm / slurm-auth-none / etc (SUSE-SU-2024:0315-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0315-1 advisory. - CVE-2023-49933: Fixed a message extension attack that could bypass the message hash bsc1218046. - CVE-2023-49936: Fixed a NULL...

OESA-2024-1110 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel before 6.5.9, there is a NULL pointer dereference in sendacknowledge in net/nfc/nci/spi.c.CVE-2023-46343 In the Linux kernel before 6.4.12, amdgpucswaitallfences in drivers/gpu/drm/amd/amdgpu/amdgpucs.c has a...

Malicious code in @time-loop/electron-panel-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd04a51a89e2d496efa31e8eacb197a77e0fe700b691b0a07851de06f9312514 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

How to Implement a Secure Incident Response Plan

Understanding the Basics of Secure Incident Response Plan A proactive strategy for coping with digital dangers calls for a well-planned process that can neutralize and diminish the harmful aftermath of unauthorized intrusion attempts and neglect of security principles. The primary aim of this...

Hacking Electronic Flight Bags. Airbus NAVBLUE Flysmart+ Manager

We’ve been testing the security of a number of different electronic flight bag, or EFB, applications for a few years now. Here’s the latest on that now it has been remediated, 19 months after our initial disclosure to Airbus. TL;DR Flysmart+ is a suite of apps for pilot EFBs, helping deliver...