8167 matches found
IXP Data EasyInstall Security Vulnerability
IXP Data EasyInstall is a remote management and deployment suite from IXP Data. A security vulnerability exists in IXP Data EasyInstall version 6.6.14884.0. An attacker can escalate privileges by exploiting the vulnerability...
Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability
Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server. TeamCity is a continuous integration/continuous...
Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 12
Package name: xms10.14.0.11222.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.11121.bin, xms10.14.0.11013.bin, xms10.14.0.10942.bin, xms10.14.0.10813.bin, xms10.14.0.10742.bin, xms10.14.0.10628.bin, xms10.14.0.10521.bin, xms10.14.0.10424.bin,...
CVE-2023-37537
An unquoted service path vulnerability in HCL AppScan Presence, deployed as a Windows service in HCL AppScan on Cloud ASoC, may allow a local attacker to gain elevated privileges...
Schneider Electric EcoStruxure Power Monitoring Expert and Power Operation Products
View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Schneider Electric Equipment : EcoStruxure Power Monitoring Expert, EcoStruxure Power Operation with Advanced Reports, EcoStruxure Power SCADA Operation with Advanced Reports Vulnerability :...
Runtime efficiency with Spring (today and tomorrow)
With Spring Framework 6.1 and Spring Boot 3.2 general availability approaching, we would like to share an overview about several efforts the Spring team is pursuing to allow developers to optimize the runtime efficiency of their applications. We are going to cover the following technologies and u...
Vulnerability of Windows operating system deployment services, allowing attackers to disclose sensitive information
The vulnerability of Windows operating system deployment services is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...
Vulnerability of Windows operating system deployment services, allowing attackers to trigger service failures
The vulnerability of Windows operating system deployment services is related to improper resource cleaning. Exploiting this vulnerability can allow a remote attacker to cause service failures...
CVE-2023-45162
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Application of the relevant hotfix remediates this issue. for v8.1.2 apply hotfix Q23166 for v8.4.1 apply hotfix Q23164 for v9.0.1 apply hotfix Q23169 SaaS implementations on v23.7.1...
The vulnerability of the Windows Deployment Services service allows a malicious individual to gain unauthorized access to confidential information.
The vulnerability of the Windows Deployment Services service in the Windows operating system is related to the lack of protection for service-related data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to confidential information...
Using Velociraptor for large-scale endpoint visibility and rapid threat hunting
TL;DR Network-wide collection, acquisition and monitoring tool for use in DFIR engagements Designed for enterprise networks 150k+ Deployments aren’t unheard of Boasts many features that your commercial EDR has, and a few more Flexible querying language that can adapt to new threats and encourages...
USN-6369-1: libwebp vulnerability | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libwebp incorrectly handled certain malformed images. If a user or automated system were tricked into opening a specially crafted image file, a remote attacker could use this issue ...
Unrestricted delegator contract deployment risks gas abuse; implement mitigations.
Lines of code Vulnerability details Impact deployProxyDelegatorIfNeeded deploys a new delegator contract if one does not exist. This could be abused to spam deploy many delegators and waste gas. Proof of Concept The issue with potentially spam deploying many delegator contracts occurs in the...
Assembly proxy creation lacks bytecode validation, enabling arbitrary contract deployment.
Lines of code Vulnerability details Impact The proxy contract creation uses assembly to compute the create2 address. But it does not verify the deployed bytecode matches expectations. The use of assemble for proxy contract creation has potential risks if the bytecode is not validated. This could...
Hash Collisions and Front-Running Risk
Lines of code Vulnerability details Salt Value in Proxy Deployment: The contract uses a salt value of 0 during the deployment of proxy delegator contracts. This introduces a significant security concern related to potential hash collisions. If multiple delegators attempt to deploy to the same...
CVE-2023-36706
Windows Deployment Services Information Disclosure Vulnerability...
CVE-2023-36706
Windows Deployment Services Information Disclosure Vulnerability...
CVE-2023-36707
Windows Deployment Services Denial of Service Vulnerability...