1881 matches found
Vulnerabilities fixed in Microsoft Azure
Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Remote code execution Administrator/Root rights Remote code execution User rights Spoofing Increased use...
KLA63957 Multiple vulnerabilities in Microsoft Azure
Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Microsoft Azure Kubernetes Service...
If only you had to worry about malware, with Jason Haddix: Lock and Code S05E04
Today on the Lock and Code podcast… If your IT and security teams think malware is bad, wait until they learn about everything else. In 2024, the modern cyberattack is a segmented, prolonged, and professional effort, in which specialists create strictly financial alliances to plant malware on...
Ski & bike helmets protect your head, not location or voice
TL;DR Livall smart ski and bike helmet app leaks the wearers real time position Group audio chat allows snooping on conversations Both issues are due to missing authorisation Bike app affects 1 million users, ski app affects a few thousand users Fixed by the vendor, but after we had to call on a...
SQLAlchemyDA SQL Injection Vulnerability
SQLAlchemyDA is a general purpose database adapter from the Zope Foundation. A SQL injection vulnerability exists in versions prior to SQLAlchemyDA 2.2, which stems from a vulnerability that allows unauthenticated execution of arbitrary SQL statements on a database to which a SQLAlchemyDA instanc...
Nervos CKB P2P DoS Attacks
The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted txhashes, it will mark it in memory to avoid duplicated requests. code → . It is easy to establish a DoS attach by generating random tx hashes. Impact It affects all nodes connected to the P2P...
PT-2024-16299
Name of the Vulnerable Software and Affected Versions The Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.28 Description The issue is related to a missing capability check on the register reference function, which allows unauthenticated attackers to update connecte...
Pwn2Own Automotive: Tesla, Sony, Alpine Players Breached on Day One
By Deeba Ahmed Bug Bounty Bonanza: Hackers Rake in Big Bucks as Connected Cars Show Security Cracks. This is a post from HackRead.com Read the original post: Pwn2Own Automotive: Tesla, Sony, Alpine Players Breached on Day One...
10 years on from the Target breach. Has building cyber security improved?
It’s over a decade since the Target data breach. It was an event that reinforced the need for supply chain security reviews. It seems that much has changed since then, or has it? Has the security profile of the average connected building in the USA improved in that time period, be it retail,...
FCC wants cars to make life harder for stalkers
Most new model cars are not just cars anymore. With multiple digital systems, vehicles are increasingly plugged into web applications and digital processes. Some of them are basically smartphones on wheels. Even if we assume these new features were all created with your convenience in mind, some ...
The vulnerability of the Azure Connected Machine Agent, a software tool for managing servers and virtual machines, is related to deficiencies in access control. This vulnerability allows attackers to escalate their privileges.
The vulnerability of the Azure Connected Machine Agent, a software tool for managing servers and virtual machines, is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
OpenSC: Potential PIN bypass when card tracks its own login state
A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock a...
CVE-2023-46144
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices...
Design/Logic Flaw
A download of code without integrity check vulnerability in PLCnext products allows an remote attacker with low privileges to compromise integrity on the affected engineering station and the connected devices...
CVE-2023-46144
CVE-2023-46144 affects Phoenix Contact PLCnext Engineer and PLCnext Control devices. Description: a download of code without integrity check allows a remote attacker with low privileges to compromise the integrity of the affected engineering station and connected devices. Root cause: missing inte...
PT-2023-29874 · Plcnext · Plcnext
Name of the Vulnerable Software and Affected Versions: PLCnext products affected versions not specified Description: A download of code without integrity check issue in PLCnext products allows a remote attacker with low privileges to compromise integrity on the affected engineering station and th...
CVE-2023-49296
The Arduino Create Agent allows users to use the Arduino Create applications to upload code to any USB connected Arduino board directly from the browser. A vulnerability in versions prior to 1.3.6 affects the endpoint /certificate.crt and the way the web interface of the ArduinoCreateAgent handle...
Vulnerabilities fixed in Microsoft Azure
Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges, gain access to sensitive data, or to impersonate another user via a cross-site scripting attack. Such an attack can lead to execution of...