Honeywell Experion Server 安全漏洞

Honeywell Experion Server is a high-performance industrial control system server from Honeywell, primarily used in the Experion Process Knowledge System PKS platform. A security vulnerability exists in Honeywell Experion Server that stems from an error in response to a specially crafted message...

PT-2024-23689 · Unknown · Pescms Team

Name of the Vulnerable Software and Affected Versions: PESCMS-TEAM version 2.3.6 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under the...

Sensitive Information in Resource Not Removed Before Reuse

Overview Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse due to a flaw in the JPEG and TGA decoders, when a specially crafted image file is passed to a software using ImageSharp. An attacker can potentially disclose sensitive...

The vulnerability of the UEFI loader’s shim, related to reading beyond the field, allows a hacker to trigger a system failure or disclose protected information.

The vulnerability of the UEFI loader “shim” is related to reading beyond the field boundary. Exploiting this vulnerability can allow an attacker to cause a system failure or disclose protected information...

Researchers Uncover First Native Spectre v2 Exploit Against Linux Kernel

Cybersecurity researchers have disclosed what they say is the "first native Spectre v2 exploit" against the Linux kernel on Intel systems that could be exploited to read sensitive data from the memory. The exploit, called Native Branch History Injection BHI, can be used to leak arbitrary kernel...

CVE-2024-31455 Minder GetRepositoryByName data leak

Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit 5c381cf added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would...

Minder GetRepositoryByName data leak

Impact A recent refactoring added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. Patches Patched in 2941 Workarounds Revert prior to...

GHSA-GGP5-28X4-XCJ9 Minder GetRepositoryByName data leak

Impact A recent refactoring added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. Patches Patched in 2941 Workarounds Revert prior to...

Stacklok Minder 安全漏洞

Minder is an open source platform that helps development teams and the open source community build more secure software and prove to others that the software they build is secure. A security vulnerability exists in Stacklok Minder version 5c381cf that stems from a data leak in GetRepositoryByName...

PT-2024-3165 · Google +5 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 124.0.6367.78 Microsoft Edge affected versions not specified Description: The issue is related to an out of bounds read in the V8 JavaScript engine handler interface, which can allow a remote attacker to leak...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from an out-of-bounds read vulnerability that stems from a lack of boundary checking in the TMUIPCGETTABLE module, which can be exploited by an attacker to obtain local information...

AZL-38281 CVE-2023-45288 affecting package etcd for versions less than 3.5.18-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

IntelBroker Leaks Alleged National Security Data Tied to US Contractor Acuity Inc.

By Waqas The leaked data was previously being sold by the IntelBroker hacker for just $3,000 in Monero XMR cryptocurrency. This is a post from HackRead.com Read the original post: IntelBroker Leaks Alleged National Security Data Tied to US Contractor Acuity Inc...

Israeli LGBTQ App Atraf Faces Data Leak, 700,000 Users Affected

By Waqas Another day, another alleged data breach putting hundred of thousands of unsuspecting users at risk. This is a post from HackRead.com Read the original post: Israeli LGBTQ App Atraf Faces Data Leak, 700,000 Users Affected...

CVE-2024-29200 API returns timesheet entries a user should not be authorized to view

Kimai is a web-based multi-user time-tracking application. The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet...

PT-2024-22803 · Kimai · Kimai

Name of the Vulnerable Software and Affected Versions: Kimai versions prior to 2.13.0 Description: The permission view other timesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the view other timesheet permission to true, on th...

INC Ransomware Hits NHS Scotland, Threatens Leak of 3TB Patient Data

By Waqas As seen by Hackread.com, the INC ransomware gang claims to have obtained patient records as part of their cyberattack. This is a post from HackRead.com Read the original post: INC Ransomware Hits NHS Scotland, Threatens Leak of 3TB Patient Data...

EulerOS Virtualization 2.11.1 : grub2 (EulerOS-SA-2024-1399)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially...

CVE-2024-2630

Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2024-2630

CVE-2024-2630 affects Google Chrome on iOS, describing an inappropriate implementation that allowed a remote attacker to leak cross-origin data via a crafted HTML page. The issue is tied to Chromium/Chrome prior to version 123.0.6312.58. Public advisories in connected feeds confirm remediation by...