CVE-2024-36358

CVE-2024-36358 affects Trend Micro Deep Security Deep Security Agent. The vulnerability is a local privilege escalation in the agent, exploitable by a user who can execute low-privileged code, by abusing a link following vulnerability to escalate to SYSTEM. Public writeups confirm the flaw lies i...

CVE-2024-36358

A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to...

Trend Micro Deep Security 安全漏洞

Trend Micro Deep Security is the United States Trend Micro Trend Micro, a server depth of security protection system client. An elevation of privilege vulnerability exists in Trend Micro Deep Security, which can be exploited by an attacker to elevate privileges and execute arbitrary code in the...

Exploit for Path Traversal in Wso2 Api_Manager

CVE-2022-29464 A preauth arbitrary file upload that leads t...

Trend Micro Deep Security Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Deep Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Trend...

Deep Java Library Security Vulnerability

Deep Java Library is an open source, high-level, engine-independent deep learning Java framework from Deep Java Library Open Source. A security vulnerability exists in Deep Java Library that stems from improper validation of file paths during tar file extraction...

CVE-2023-51219

A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access tok...

SASE Threat Report: 8 Key Findings for Enterprise Security

Threat actors are evolving, yet Cyber Threat Intelligence CTI remains confined to each isolated point solution. Organizations require a holistic analysis across external data, inbound and outbound threats and network activity. This will enable evaluating the true state of cybersecurity in the...

RHEL 7 : screen (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - screen: Stack overflow due to deep recursion causing process freeze CVE-2015-6806 Note that Nessus has not tested f...

PT-2024-14074 · Kakao · Kakaotalk

Name of the Vulnerable Software and Affected Versions: KakaoTalk version 10.4.3 Description: A deep link validation issue allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leak...

CVE-2023-51219

A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access tok...

CVE-2023-51219

A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access tok...

RHEL 8 : kibana (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nodejs-set-value: prototype pollution in function set-value CVE-2019-10747 - mixin-deep is vulnerable to...

Report: The Dark Side of Phishing Protection

The transition to the cloud, poor password hygiene and the evolution in webpage technologies have all enabled the rise in phishing attacks. But despite sincere efforts by security stakeholders to mitigate them - through email protection, firewall rules and employee education - phishing attacks ar...

Friday Squid Blogging: Dana Squid Attacking Camera

Fantastic footage of a Dana squid attacking a camera at a depth of about a kilometer. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

jackson-databind: denial of service via a large depth of nested objects

A flaw was found in the Jackson Databind package. This cause of the issue is due to a Java StackOverflow exception and a denial of service via a significant depth of nested objects...

Blackprint 安全漏洞

Blackprint is a visual programming interface from Blackprint Open Source. A security vulnerability exists in blackprint version v.0.9.0, which originated from a vulnerability that allows attackers to execute arbitrary code via the utils.setDeepProperty function of engine.min.js...

PT-2024-20341 · Unknown · @Blackprint/Engine

Name of the Vulnerable Software and Affected Versions: @blackprint/engine versions 0.8.12 through 0.9.1 Description: A Prototype Pollution issue allows an attacker to execute arbitrary code via the utils.setDeepProperty function of engine.min.js. This issue enables the execution of arbitrary code...

PT-2024-40775 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ crash occurred, involving the functions check content type and change protocol, process request, and ndpi check http tcp...

RHEL 8 : nodejs-mixin-deep (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - nodejs-mixin-deep: prototype pollution in function mixin-deep CVE-2019-10746 Note that Nessus has not tested for th...