Medium: ansible-core

Issue Overview: The upstream report describes this issue as follows: When installing a maliciously created Ansible role using 'ansible-galaxy role install', arbitrary files the user has access to can be overwritten. The malicious role must contain a symlink with an absolute path to the target fil...

IBM Security Access Manager Container 代码问题漏洞

IBM Security Access Manager is a product for information security management applications from International Business Machines IBM. The product enables access management control through integrated appliances for web, mobile and cloud computing. An XML external entity injection vulnerability exist...

CVE-2024-24755

The CVE-2024-24755 entry concerns the Discourse plugin discourse-group-membership-ip-block. The connected sources describe a information-disclosure vulnerability where the plugin sends all group custom fields to the client, including fields from other plugins that are expected to remain secret. A...

Stopping Credential Stuffing Attacks: We Need to Do Better

Do you know what 23andMe, Jason's Deli, North Face, and Hot Topic have in common? They've all been breached by successful credential stuffing attacks in the last year! An attack type that has gained prominence in recent years is credential stuffing. In this blog, we will explore what credential...

SUSE CVE-2023-5992

A vulnerability was found in OpenSC where PKCS1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data...

AZL-34088 CVE-2023-5992 affecting package opensc for versions less than 0.23.0-3

A vulnerability was found in OpenSC where PKCS1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data...

kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip

A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sltxtimeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information...

kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip

A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sltxtimeout in drivers/net/slip/slip.c. This issue could allow an attacker to crash the system or leak internal kernel information...

kernel: out-of-bounds access in relay_file_read

An out-of-bounds OOB memory access flaw was found in the Linux kernel in relayfilereadstartpos in kernel/relay.c in the relayfs. This flaw allows a local attacker to crash the system or leak kernel internal information...

Design/Logic Flaw

Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2024-0804

Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-0811

Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2024-0811

Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Low...

CVE-2024-0811

CVE-2024-0811 describes an insecure Extensions API implementation in Google Chrome prior to 121.0.6167.85 that could allow a user-assisted attacker to leak cross-origin data via a malicious extension. The issue is tied to Chrome/Chromium’s Extensions API and is labeled with a low severity. Affect...

CVE-2024-0810

Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Chromium security severity: Medium...

EBYTE E880-IR01 Security Vulnerability

EBYTE E880-IR01 is a 4G wireless router from EBYTE, China. A security vulnerability exists in EBYTE E880-IR01 version V1.1. An attacker can exploit this vulnerability to obtain sensitive information via a specially crafted /cgi-bin/luci POST request...

CVE-2023-50950

IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709...

Hathway Router CM5100 Cross-Site Scripting Vulnerability

Hathway Router is a router from Hathway India. The Hathway Router CM5100 suffers from a cross-site scripting vulnerability that stems from multiple vulnerabilities in the router, which could allow a remote attacker to perform a stored cross-site scripting XSS attack, obtain sensitive information,...

UBUNTU-CVE-2024-0553

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange,...

PT-2024-6073 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 121.0.6167.139 Description: The issue is related to an out of bounds read in the V8 component of Google Chrome, allowing a remote attacker to potentially access confidential data by using a specially crafted HT...