COVESA vsomeip 竞争条件问题漏洞

vsomeip is an open source implementation of a scalable service-oriented IP middleware from the Connected Vehicle Systems Alliance. A Competitive Conditions Issue vulnerability exists in COVESA vsomeip versions prior to 3.4.10 that stems from the inclusion of a competitive condition...

Researchers Discover LG Smart TV Vulnerabilities Allowing Root Access

Multiple security vulnerabilities have been disclosed in LG webOS running on its smart televisions that could be exploited to bypass authorization and gain root access on the devices. The findings come from Romanian cybersecurity firm Bitdefender, which discovered and reported the flaws in Novemb...

Automakers Are Sharing Driver Data with Insurers without Consent

Kasmir Hill has the story: Modern cars are internet-enabled, allowing access to services like navigation, roadside assistance and car apps that drivers can connect to their vehicles to locate them or unlock them remotely. In recent years, automakers, including G.M., Honda, Kia and Hyundai, have...

CVE-2024-23250

An access issue was addressed with improved access restrictions. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, watchOS 10.4. An app may be able to access Bluetooth-connected microphones without user permission...

Design/Logic Flaw

An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 17.4, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, watchOS 10.4. An app may be able to access Bluetooth-connected microphones without user permission...

CVE-2024-22383

Missing release of resource after effective lifetime CWE-772 in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service. This issue affects: All variants of the...

CVE-2024-22383

Missing release of resource after effective lifetime CWE-772 in the Controller 7000 resulted in HBUS connected T-Series readers to not automatically recover after coming under attack over the RS-485 interface, resulting in a persistent denial of service. This issue affects: All variants of the...

CVE-2021-47086

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: refuse to enable an unbound pipe This ioctl implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur: 1 We'd...

The vulnerability of the Azure Connected Machine Agent, a software tool for managing servers and virtual machines, relates to the tracking of symbolic links. This vulnerability allows an attacker to escalate their privileges.

The vulnerability of the Azure Connected Machine Agent, a software tool for managing servers and virtual machines, is related to the tracking of symbolic links. Exploiting this vulnerability can allow an attacker to increase their privileges...

Directory traversal

A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An attacker may be able to access connected network volumes mounted in the home directory...

CVE-2023-42836

A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.2. An attacker may be able to access connected network volumes mounted in the home directory...

CVE-2024-21329

Azure Connected Machine Agent Elevation of Privilege Vulnerability...

CVE-2024-21329

Azure Connected Machine Agent Elevation of Privilege Vulnerability...

CVE-2024-21329 Azure Connected Machine Agent Elevation of Privilege Vulnerability

...

CVE-2024-21329

CVE-2024-21329 affects Microsoft Azure Connected Machine Agent. Connected docs identify an elevation-of-privilege issue in the Azure Connected Machine Agent (root cause described by PT-2024-1823 as a symbolic link tracking vulnerability). CVSS indicates local access with low attack complexity and...

CVE-2024-21329 Azure Connected Machine Agent Elevation of Privilege Vulnerability

...

Azure Connected Machine Agent Elevation of Privilege Vulnerability

...

Microsoft Azure Connected Machine Agent Security Vulnerability

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Azure Connected Machine Agent. No information about this vulnerability is available at this time, so stay tuned to CNNVD...

CVE-2024-21329: Improper Link Resolution Before File Access

Azure Connected Machine Agent Elevation of Privilege Vulnerability...

Security Updates for Azure Connected Machine Agent (February 2024)

The Microsoft Azure Connected Machine Agent running on the remote host is prior to 1.38. It is, therefore affected by an elevation of privilege vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVE...