Security Bulletin: IBM Cloud Pak for Data is vulnerable to bypass SAML authentication due to passport-saml ( CVE-2022-39299 )

Summary Passport-saml is used by IBM Cloud Pak for Data for SAML authentication. CVE-2022-39299. Vulnerability Details CVEID:CVE-2022-39299 DESCRIPTION: Node.js passport-saml module could allow a remote attacker to bypass security restrictions, caused by improper verification of cryptographic...

Exploit for Improper Restriction of Excessive Authentication Attempts in Logsign Unified_Secops_Platform

Logsign SIEM RCE Exploit CVE-2024-5716 & CVE-2024-5717 This...

CVE-2024-6472

A vulnerability was found in versions of LibreOffice from 24.2 to before 24.2.5. When a document containing a signed macro fails verification, LibreOffice will display a warning which the user can choose to ignore the failure and enable the macro anyways. Mitigation Mitigation for this issue is...

PT-2024-6440 · Teamviewer · Teamviewer

Name of the Vulnerable Software and Affected Versions: TeamViewer Remote Clients versions prior to 15.58.4 Description: The issue is related to the improper verification of cryptographic signatures during the installation of a VPN driver via the TeamViewer service.exe component. This allows an...

PT-2024-27987 · Qualcomm · 315 5G Iot Modem Firmware +210

Name of the Vulnerable Software and Affected Versions: No specific software or affected versions are mentioned in the provided descriptions. Description: A cryptographic issue occurs when a controller receives an LMP start encryption command under unexpected conditions. Recommendations: At the...

USN-6895-4: Linux kernel vulnerabilities

It was discovered that the ATA over Ethernet AoE driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2023-6270 It was discovered that the HugeTLB file syst...

0x-relayer-cat (>=0.0.2, <=0.0.10), 0xauth (>=0.0.2, <=0.0.6) +8132 more potentially affected by CVE-2024-42459 via elliptic (>=4.1.0, <=6.5.6)

elliptic NPM version =4.1.0, =0.0.2, =0.0.2, =1.0.6-beta.1, =0.0.1-beta.1, =0.1.0, =0.0.92, =0.1.3, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2024-42459 Source advisory: OSV:GHSA-F7Q4-PWC6-W24P...

0x-relayer-cat (>=0.0.2, <=0.0.10), 0xauth (>=0.0.2, <=0.0.6) +8129 more potentially affected by CVE-2024-42461 via elliptic (>=5.2.1, <=6.5.6)

elliptic NPM version =5.2.1, =0.0.2, =0.0.2, =1.0.6-beta.1, =0.0.1-beta.1, =0.1.0, =0.0.92, =0.1.3, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2024-42461 Source advisory: OSV:GHSA-49Q7-C7J4-3P7M...

0x-relayer-cat (>=0.0.2, <=0.0.10), 0xauth (>=0.0.2, <=0.0.6) +8814 more potentially affected by CVE-2024-42460 via elliptic (>=2.0.2, <=6.5.6)

elliptic NPM version =2.0.2, =0.0.2, =0.0.2, =1.0.6-beta.1, =0.0.1-beta.1, =1.0.0, =0.1.0, =0.0.92, =0.1.3, =4.2.1, =6.2.1, =6.2.4 and more Source cves: CVE-2024-42460 Source advisory: OSV:GHSA-977X-G7H5-7QGW...

PT-2024-29954

Name of the Vulnerable Software and Affected Versions Elliptic package version 6.5.6 Description The issue concerns EDDSA signature malleability due to a missing signature length check, allowing zero-valued bytes to be removed or appended. This is a cryptographic weakness that can be exploited...

Ubuntu 22.04 LTS : Linux kernel vulnerabilities (USN-6895-4)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6895-4 advisory. It was discovered that the ATA over Ethernet AoE driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. An...

PT-2024-29956 · Elliptic +1 · Elliptic +1

Name of the Vulnerable Software and Affected Versions: Elliptic package version 6.5.6 Description: The issue concerns ECDSA signature malleability due to a missing check for whether the leading bit of r and s is zero. This results in a cryptographic weakness. There is no information provided abou...

CVE-2024-28972

Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure...

CVE-2024-28972

Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure...

CVE-2024-28972

Dell InsightIQ 5.0.0 is affected by a use of a broken or risky cryptographic algorithm that could be exploited by an unauthenticated remote attacker to cause information disclosure. The vulnerability is documented across multiple sources indicating affected versions include 5.0.0 and prior to 5.0...

CVE-2024-28972

Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure...

CVE-2024-28972

Dell InsightIQ, Verion 5.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure...

PT-2024-41463 · Moxa · Moxa Eds-510E

Уязвимость микропрограммного обеспечения коммутаторов Moxa EDS-510A связана с использованием криптографических алгоритмов, содержащих дефекты. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, повысить свои привилегии...

ROS-20240731-06

A vulnerability in the SHA-3 cryptographic hash function of the eXtended Keccak Code Package XKCP software package is related to errors in block processing of input data and type conversion. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code during...

ROS-20240731-05

A vulnerability in the SHA-3 cryptographic hash function of the eXtended Keccak Code Package XKCP software package is related to errors in block processing of input data and type conversion. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code during...