CVE-2024-10748

Cosmote Greece What’s Up App 4.47.3 (Android) is affected by CVE-2024-10748 in the Realm Database Handler. The issue arises from manipulating the defaultRealmKey in RealmDB.java, causing use of a default cryptographic key. Local access is required; attack complexity is high and exploitation is co...

CVE-2024-10748: Use of Default Cryptographic Key

A vulnerability, which was classified as problematic, has been found in Cosmote Greece What's Up App 4.47.3 on Android. This issue affects some unknown processing of the file gr/desquared/kmmsharedmodule/db/RealmDB.java of the component Realm Database Handler. The manipulation of the argument...

RHEL 7 : Red Hat Enterprise Linux OpenStack Platform Installer update (Important) (RHSA-2015:0791)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0791 advisory. Red Hat Enterprise OpenStack Platform Installer is a deployment management tool. It provides a web user interface for managing the installation and...

RHEL 6 : openstack-packstack and openstack-puppet-modules update (Important) (RHSA-2015:0832)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0832 advisory. PackStack is a command-line utility for deploying OpenStack on existing servers over an SSH connection. Deployment options are provided either...

Cosmote What’s Up 安全漏洞

Cosmote What's Up is an application from Cosmote Inc. A security vulnerability exists in Cosmote What's Up version 4.47.3, which stems from the mishandling of the parameter defaultRealmKey on the Android platform, resulting in the use of a default encryption key...

RHEL 7 : openstack-packstack and openstack-puppet-modules (RHSA-2015:0789)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0789 advisory. PackStack is a command-line utility for deploying OpenStack on existing servers over an SSH connection. Deployment options are provided either...

SUSE CVE-2024-7594

Vault's SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and defaultuser fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault's SSH secrets engine could be used to...

SUSE CVE-2024-9486

A security issue was discovered in the Kubernetes Image Builder versions = v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be...

SUSE CVE-2024-47825

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

PT-2024-16512 · Cosmote Greece · Cosmote Greece What'S Up App

Name of the Vulnerable Software and Affected Versions: Cosmote Greece What's Up App version 4.47.3 Description: A problematic issue has been found in the Cosmote Greece What's Up App, affecting the Realm Database Handler component, specifically the file gr/desquared/kmmsharedmodule/db/RealmDB.jav...

Zero-Click Flaw Exposes Potentially Millions of Popular Storage Devices to Attack

A vulnerability categorized as “critical” in a photo app installed by default on Synology network-attached storage devices could give attackers the ability to steal data and worse...

CVE-2024-9191: Incorrect Default Permissions

The Okta Device Access features, provided by the Okta Verify agent for Windows, provides access to the OktaDeviceAccessPipe, which enables attackers in a compromised device to retrieve passwords associated with Desktop MFA passwordless logins. The vulnerability was discovered via routine...

firefox security update

128.4.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 128.4.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 128.4.0-1 - Update to 128.4.0 build1...

Android malware FakeCall intercepts your calls to the bank

An Android banking Trojan called FakeCall is capable of hijacking the phone calls you make to your bank. Instead of reaching your bank, your call will be redirected to the cybercriminals. The Trojan accomplishes this by installing itself as the default call handler on the infected device. The...

PT-2024-7891 · Futurenet · Futurenet Nxr Series Routers

Name of the Vulnerable Software and Affected Versions: FutureNet NXR series routers affected versions not specified Description: The issue concerns the unexpected enabling of REST-APIs in the initial configuration of FutureNet NXR series routers, provided that either http-server GUI or Web...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48272

D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the device via a bruteforce attack...

CVE-2024-48271

D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack...

PT-2024-29708 · Unknown · Acr.Browser.Lightning +1

Name of the Vulnerable Software and Affected Versions: com.videodownload.browser.videodownloader aka AppTool-Browser-Video All Video Downloader version 20-30.05.24 Description: The issue allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity...

CVE-2024-48271

D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers to bypass authentication and escalate privileges on the device via a bruteforce attack...