16643 matches found
kernel: serial: core: fix transmit-buffer reset and memleak
In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 "tty: serialcore: convert uartclose to use ttyportclose" converted serial core to use ttyportclose but failed to notice that the transmit buffer still needs ...
kernel: vt_ioctl: fix array_index_nospec in vt_setactivate
A vulnerability was found in the Linux kernel's vtioctl subsystem, where the vtsetactivate function can lead to a transient integer underflow due to improper handling of the vsa.console value. The vulnerability arises when an out-of-bounds value is decreased before being sanitized using...
PT-2024-30619 · Unknown · Progauge Maglink Lx Console
Name of the Vulnerable Software and Affected Versions: ProGauge MAGLINK LX CONSOLE affected versions not specified Description: An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly. Recommendations: At the moment,...
PT-2024-29540 · Unknown · Progauge Maglink Lx Console
Name of the Vulnerable Software and Affected Versions: ProGauge MAGLINK LX CONSOLE affected versions not specified Description: The issue is related to insufficient filtering on input fields used to render pages, which may allow cross-site scripting. Recommendations: At the moment, there is no...
PT-2024-11664 · Ibm · Ibm Aspera Console
Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information from the cookie. This could be exploited by a remote attacker...
PT-2024-31586 · Unknown · Progauge Maglink Lx4 Console
Name of the Vulnerable Software and Affected Versions: ProGauge MAGLINK LX4 CONSOLE affected versions not specified Description: A valid user can change their privileges to administrator once logged in to the ProGauge MAGLINK LX4 CONSOLE. Recommendations: At the moment, there is no information...
PT-2024-10999 · Ibm · Ibm Aspera Console
Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is caused by a CSV injection vulnerability, which could allow a remote authenticated attacker to execute arbitrary code on the system. This can be achieved by persuading a...
Sony XAV-AX5500 security vulnerabilities
The SONY XAV-AX5500 is a 7-inch in-vehicle center console with a wide range of functions and advanced technical features. A code execution vulnerability exists in the SONY XAV-AX5500 that stems from a lack of proper validation of software update packages and can be exploited by an attacker to...
Veeam Service Provider Console NTLM Authentication Bypass
The vulnerability of the NTLM protocol implementation in the backup and recovery software for remote and cloud-based Veeam Service Provider Consoles is related to insufficient protection of service data. Exploiting this vulnerability allows a malicious actor to bypass authentication procedures an...
Veeam Service Provider Console Improper Code Generation Code Execution
The vulnerability of the backup and data recovery software for Veeam Service Provider Console VSPC for remote and cloud-based customers is related to improper code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...
mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...
mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...
mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...
mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...
How to Investigate ChatGPT activity in Google Workspace
When you connect your organization's Google Drive account to ChatGPT, you grant ChatGPT extensive permissions for not only your personal files, but resources across your entire shared drive. As you might imagine, this introduces an array of cybersecurity challenges. This post outlines how to see...
mozilla: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
The Mozilla Foundation's Security Advisory: Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence...
SUSE CVE-2024-46703
In the Linux kernel, the following vulnerability has been resolved: Revert "serial: 8250omap: Set the console genpd always on if no console suspend" This reverts commit 68e6939ea9ec3d6579eadeab16060339cdeaf940. Kevin reported that this causes a crash during suspend on platforms that dont use PM...
SolarWinds Access Rights Manager RabbitMQ Access
The vulnerability of the SolarWinds Access Rights Manager ARM lies in the use of strictly encrypted credentials. Exploiting this vulnerability could allow a malicious actor to gain access to the RabbitMQ management console remotely...
