Authorities Take Down Criminal Encrypted Messaging Platform MATRIX

Another day, another cybercrime operation shut down - this time, Europol has dismantled the MATRIX encrypted messaging service...

Security Bulletin: Security Vulnerabilities in base image packages affect IBM Voice Gateway

Summary Security Vulnerabilities in base image packages affect IBM Voice Gateway. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-39338 DESCRIPTION: Axios is vulnerable to server-side request forgery, caused by a flaw with requests for path relative URLs get processe...

The vulnerability of the mcast component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the mcast component in the Linux operating system’s kernel is related to resource management errors in the ipv6mcdown function. Exploiting this vulnerability can allow an attacker to cause a service failure...

kernel: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix data-race in ipv6mcdown / mldifcwork idev-mcifccount can be written over without proper locking. Originally found by syzbot 1, fix this issue by encapsulating calls to mldifcstopwork and mldgqstopwork for good...

Malicious code in pupeteer-autoscroll-down (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07b42fbcf99a7e9c692dfe053d165eda55a768e69368aa7f9b0aa53e500a3a5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10516 Malicious code in pupeteer-autoscroll-down (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07b42fbcf99a7e9c692dfe053d165eda55a768e69368aa7f9b0aa53e500a3a5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in puppeteerscroll-down (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef54ed97acfe5ef98e20301d2c06ccf2391055cb225e5c1cc48bc06950e82d6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10521 Malicious code in puppeteerscroll-down (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef54ed97acfe5ef98e20301d2c06ccf2391055cb225e5c1cc48bc06950e82d6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-50114

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Unregister redistributor for failed vCPU creation Alex reports that syzkaller has managed to trigger a use-after-free when tearing down a VM: BUG: KASAN: slab-use-after-free in kvmputkvm+0x300/0xe68...

CVE-2024-50098

The CVE-2024-50098 issue affects the Linux kernel SCSI UFS core. The root cause was a deadlock during reboot at boot start: SDEV_QUIESCE was set for all logical units, causing an audio-driver thread to wait on blk_mq_submit_bio(), which held a mutex. The fix changes behavior by marking all LUs of...

PT-2024-37063

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, involving IPv6 and device removal. The issue occurred during device removal in the pmtu.sh self-test, causing an aperiodic hangup...

Exploit for CVE-2024-9926

wordpress-jetpack-broken-access-control-vulnerable-application...

Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget

Cross-site request forgery CSRF vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to 1 change us...

CVE-2024-26272

Cross-site request forgery CSRF vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to 1 change user passwords, 2...

CVE-2024-26271

Cross-site request forgery CSRF vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 update 75 through update 92 and 7.3 update 32 through update 36 allows remote attackers to 1 change us...

CVE-2024-26272

Cross-site request forgery CSRF vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to 1 change user passwords, 2...

CVE-2024-26272

Cross-site request forgery CSRF vulnerability in the content page editor in Liferay Portal 7.3.2 through 7.4.3.107, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92 and 7.3 GA through update 35 allows remote attackers to 1 change user passwords, 2...

SUSE CVE-2022-49008

In the Linux kernel, the following vulnerability has been resolved: can: can327: can327feedframetonetdev: fix potential skb leak when netdev is down In can327feedframetonetdev, it did not free the skb when netdev is down, and all callers of can327feedframetonetdev did not free allocated skb too...

AZL-51386 CVE-2024-50022 affecting package kernel for versions less than 6.6.57.1-1

In the Linux kernel, the following vulnerability has been resolved: device-dax: correct pgoff align in daxsetmapping pgoff should be aligned using ALIGNDOWN instead of ALIGN. Otherwise, vmf-address not aligned to faultsize will be aligned to the next alignment, that can result in memory failure...

UBUNTU-CVE-2024-50040

In the Linux kernel, the following vulnerability has been resolved: igb: Do not bring the device up after non-fatal error Commit 004d25060c78 "igb: Fix igbdown hung on surprise removal" changed igbioerrordetected to ignore non-fatal pcie errors in order to avoid hung task that can happen when...