DSpace Security Vulnerabilities

DSpace is an open source turnkey repository application for the DuraSpace community. A security vulnerability exists in DSpace versions 7.0 through 7.6.1, which stems from the possibility that a user's browser may execute any embedded JavaScript when an HTML, XML, or JavaScript Bitstream is...

Malicious code in active-model_serializers-jsonapi_embedded_records_deserializer (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

(Pwn2Own) HP Color LaserJet Pro MFP 4301fdw CFF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of HP Color LaserJet Pro MFP 4301fdw printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of embedded fonts. The issue results fr...

io.undertow:undertow-servlet (1.0.0.cr5), io.undertow:undertow-websockets-jsr (1.0.0.cr5) +2 more potentially affected by CVE-2024-6162 via io.undertow:undertow-core (1.0.0.cr5)

io.undertow:undertow-core MAVEN version 1.0.0.cr5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.cr5 - io.undertow:undertow-websockets-jsr 1.0.0.cr5 -...

web interface arbitrary file upload

The vulnerability of the web interface of microprogramming software for devices for remote control of lighting and energy consumption in Schneider Electric Sage is related to the default access settings. Exploiting this vulnerability allows a malicious actor to upload arbitrary files and embedded...

Helpful tools to get started in IoT Assessments

The Internet of Things IoT can be a daunting field to get into. With many different tools and products available on the market it can be confusing to even know where to start. Having performed dozens of IoT assessments, I felt it would be beneficial to compile a basic list of items that are...

CVE-2024-5995 Soar Cloud HR Portal - Insufficient Session Expiration

The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused...

CVE-2024-5995 Soar Cloud HR Portal - Insufficient Session Expiration

The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the session is not properly configured, remaining valid for more than 7 days and can be reused...

Unspecified Vulnerability in SAP PDFViewer (CNVD-2024-27892)

SAP PDFViewer is the United States SAP SAP a PDF viewer. A security vulnerability exists in SAP PDFViewer that stems from the fact that if a PDF document contains embedded JavaScript, PDFViewer will execute the embedded JavaScript in the PDF, which could lead to a potential security threat. No...

PT-2024-37301 · Unknown · Soar Cloud Hr Portal

Name of the Vulnerable Software and Affected Versions: Soar Cloud HR Portal affected versions not specified Description: The issue concerns notification emails sent by Soar Cloud HR Portal, which contain a link with embedded session data. These emails are sent without using an encrypted...

Dell BIOS Input Validation Error Vulnerability

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell USA. The Dell BIOS has an input validation error vulnerability that stems from an improper input validation vulnerability in an externally developed component, which could be exploited by an attacker to caus...

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2024:1984-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1984-1 advisory. - CVE-2023-50711: Fixed out of bounds memory accesses in embedded vmm-sys-util bsc1218501. Tenable has extracted the preceding...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 Basic POC to test CVE-2024-3094 vulnerability in...

June 11, 2024—KB5039289 (Monthly Rollup)

June 11, 2024—KB5039289 Monthly Rollup Applies To Windows Server 2008 R2 Premium Assurance End of support information Note As of January 10, 2023, Microsoft no longer provides security updates or technical support for Windows 7 Service Pack 1 SP1. We recommend that you upgrade to a supported...

June 11, 2024—KB5039274 (Security-only update)

June 11, 2024—KB5039274 Security-only update Applies To Windows Server 2008 R2 Premium Assurance End of support information Note As of January 10, 2023, Microsoft no longer provides security updates or technical support for Windows 7 Service Pack 1 SP1. We recommend that you upgrade to a supporte...

SPI Lock Bypass

Bulletin ID: AMD-SB-1041 Potential Impact: System Integrity Severity: High Summary Potential weaknesses in AMD’s SPI protection features may allow an attacker to bypass the native System Management Mode SMM ROM protections. CVE Details CVE-2022-23829 A potential weakness in AMD SPI protection...

Fedora: Security Advisory for qt5-qtx11extras (FEDORA-2024-2e27372d4c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for qt5-qtquickcontrols2 (FEDORA-2024-2e27372d4c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-36795

Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.541.0.1 allows attackers to access URLs and directories embedded within the firmware via unspecified vectors...

Netgear WNR614 Security Vulnerability

The Netgear WNR614 is an N300 wireless router with external antenna from Netgear USA. A security vulnerability exists in the Netgear WNR614 version V1.1.0.541.0.1, which stems from the presence of insecure privileges that allow an attacker to access URLs and directories embedded in the firmware v...