Ongoing Cyber Attacks Exploit Critical Vulnerabilities in Cisco Smart Licensing Utility

Two now-patched security flaws impacting Cisco Smart Licensing Utility are seeing active exploitation attempts, according to SANS Internet Storm Center. The two critical-rated vulnerabilities in question are listed below - CVE-2024-20439 CVSS score: 9.8 - The presence of an undocumented static us...

Vulnerability of the mhi_register_controller() function in the drivers/bus/mhi/core/init.c module – This driver of the MHI bus in the Linux kernel allows a hacker to cause a service failure.

Vulnerability of the mhiregistercontroller function in the drivers/bus/mhi/core/init.c module – The MHI bus driver in the Linux kernel is vulnerable due to incorrect input validation. Exploiting this vulnerability could allow an attacker to cause system failures...

The vulnerability of Zoom, a software platform for conducting video conferences, allows attackers to escalate their privileges.

The vulnerability of Zoom, a video conferencing software, is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.14.3 security update

An update is now available for Red Hat OpenShift GitOps v1.14.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Apple macOS 安全漏洞

Apple macOS Sonoma is a version of the Mac operating system released by Apple on June 5, 2023, featuring upgrades in personalized settings, video conferencing, the Safari browser, and the gaming experience. Apple macOS Sonoma suffers from an out-of-bounds read vulnerability that stems from...

CentralSquare eTRAKiT 安全漏洞

CentralSquare eTRAKiT is a public online portal from CentralSquare, Inc. that interacts with internal community development systems. A security vulnerability exists in CentralSquare eTRAKiT version 3.2.1.77, which stems from improper input validation and could allow a remote, unauthenticated...

Critical mySCADA myPRO Flaws Could Let Attackers Take Over Industrial Control Systems

Cybersecurity researchers have disclosed details of two critical flaws impacting mySCADA myPRO, a Supervisory Control and Data Acquisition SCADA system used in operational technology OT environments, that could allow malicious actors to take control of susceptible systems. "These vulnerabilities,...

The vulnerability of the nested_get_evmcs_page() function in the arch/x86/kvm/vmx/nested.c module of the virtualization subsystem on the Linux operating system’s x86 kernel platform allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the nestedgetevmcspage function in the arch/x86/kvm/vmx/nested.c module of the virtualization subsystem on the Linux operating system’s x86 kernel platform is related to incorrect input validation. Exploiting this vulnerability could allow an attacker to compromise the...

AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH

IBM SECURITY ADVISORY First Issued: Mon Mar 17 15:30:45 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory18.asc Security Bulletin: AIX is vulnerable to a denial of service CVE-2025-26466 and a machine-in-the-middl...

CVE-2021-44521 vulnerabilities

Vulnerabilities for packages: druid...

USN-7328-3 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15 vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

The vulnerability of the software for managing assets and processes in Cityworks and Cityworks with Office Companion, related to deficiencies in deserialization mechanisms, allows attackers to execute remote code.

The vulnerability of the Cityworks and Cityworks with Office Companion asset management and process management software lies in the deficiencies of the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute malicious code remotely...

USN-7351-1 resteasy vulnerabilities

Nikos Papadopoulos discovered that RESTEasy improperly handled URL encoding when certain errors occur. An attacker could possibly use this issue to modify the app's behavior for other users through the network. CVE-2020-10688 Mirko Selber discovered that RESTEasy improperly validated user input...

GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks

Two high-severity security flaws have been disclosed in the open-source ruby-saml library that could allow malicious actors to bypass Security Assertion Markup Language SAML authentication protections. SAML is an XML-based markup language and open-standard used for exchanging authentication and...

USN-7325-3 linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service system crash or possibly execute arbitrary code...

Siemens SCALANCE X-200RNA Switch Devices Exposure of Sensitive Information to an Unauthorized Actor (CVE-2016-0704)

An oracle protection mechanism in the getclientmasterkey function in s2srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier fo...

Mozilla Thunderbird Security Update (mfsa_2024-44) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

URGENT: Microsoft Patches 57 Security Flaws, Including 6 Actively Exploited Zero-Days

Microsoft on Tuesday released security updates to address 57 security vulnerabilities in its software, including a whopping six zero-days that it said have been actively exploited in the wild. Of the 56 flaws, six are rated Critical, 50 are rated Important, and one is rated Low in severity...

The vulnerability of the WebHMI component of the EcoStruxure Power Automation System User Interface (EcoSUI) and the EcoStruxure Microgrid Operation Large (EMO-L) system, which allows a hacker to gain unauthorized access to the device.

The vulnerability of the WebHMI component of the SCADA system EcoStruxure Power Automation System User Interface EcoSUI and the EcoStruxure Microgrid Operation Large EMO-L system for optimizing distributed energy resources is related to insecure initialization of the resources. Exploiting this...