8964 matches found
The vulnerability of the Rockwell Automation FactoryTalk View SE HMI software, related to deficiencies in authentication procedures, allows a intruder to disclose protected information.
The vulnerability of the Rockwell Automation FactoryTalk View SE human-machine interface management software is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow a malicious actor to disclose protected information...
The vulnerability of the Adobe FrameMaker Publishing Server (FMPS) in automating document publishing and content management processes stems from authentication procedures that have flaws. This allows attackers to exploit these vulnerabilities to increase their privileges.
The vulnerability of the Adobe FrameMaker Publishing Server FMPS in automating document publishing and content management processes is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
VMware Address Critical Heap-Overflow and Privilege Escalation Flaws
...
Mozilla: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12
The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...
New Fickle Stealer Exploits Software Flaws to Steal Crypto, Browser Data
Fortinet's FortiGuard Labs exposes the Fickle Stealer, a malware using multiple attack methods to steal logins, financial details, and more. Learn how to protect yourself from this evolving threat...
Chinese Cyber Espionage Targets Telecom Operators in Asia Since 2021
Cyber espionage groups associated with China have been linked to a long-running campaign that has infiltrated several telecom operators located in a single Asian country at least since 2021. "The attackers placed backdoors on the networks of targeted companies and also attempted to steal...
Vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks—related to deficiencies in authentication procedures, allowing attackers to circumvent existing security restrictions.
The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks are related to deficiencies in authentication procedures. Exploiting these vulnerabilities can allow attackers to bypass existing securi...
Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty, libcurl, Apache Xerces C++ XML parser, and Newtonsoft.Json may affect IBM Storage Protect for Virtual Environments: Data Protection for Hyper-V
Summary IBM Storage Protect for Virtual Environments: Data Protection for Hyper-V can be affected by security flaws in IBM WebSphere Application Server Liberty, libcurl, Apache Xerces C++ XML parser, and Newtonsoft.Json. The flaws can lead to server-side request forgery, bypass of security...
VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi
VMware has released updates to address critical flaws impacting Cloud Foundation, vCenter Server, and vSphere ESXi that could be exploited to achieve privilege escalation and remote code execution. The list of vulnerabilities is as follows - CVE-2024-37079 & CVE-2024-37080 CVSS scores: 9.8 -...
The vulnerability of the Veeam Agent for Microsoft Windows data backup tool stems from authentication procedures that have flaws, allowing attackers to exploit their privileges.
The vulnerability of the Veeam Agent for Microsoft Windows data backup tool is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to gain increased privileges...
The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks lies in their authentication procedures’ flaws, which allow attackers to exploit these vulnerabilities to increase their privileges.
The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks are related to deficiencies in authentication procedures. Exploiting these vulnerabilities can allow attackers to enhance their privileg...
Vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks—due to authentication procedures that lack sufficient security measures—allows attackers to circumvent existing security restrictions.
The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce Webhooks are related to deficiencies in authentication procedures. Exploiting these vulnerabilities can allow attackers to circumvent existing...
CVE-2024-37305
oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODEUINT32 at the start of...
CVE-2024-37305 Buffer overflow in deserialization in oqs-provider
oqs-provider is a provider for the OpenSSL 3 cryptography library that adds support for post-quantum cryptography in TLS, X.509, and S/MIME using post-quantum algorithms from liboqs. Flaws have been identified in the way oqs-provider handles lengths decoded with DECODEUINT32 at the start of...
CVE-2024-37305
CVE-2024-37305 affects the oqs-provider (OpenSSL 3 post-quantum provider) where lengths decoded with DECODE_UINT32 at the start of serialized hybrid keys/signatures are unchecked, enabling out-of-bounds memory reads/writes that can crash or leak information. The issue does not affect plain/non-hy...
ASUS Patches Critical Authentication Bypass Flaw in Multiple Router Models
ASUS has shipped software updates to address a critical security flaw impacting its routers that could be exploited by malicious actors to bypass authentication. Tracked as CVE-2024-3080, the vulnerability carries a CVSS score of 9.8 out of a maximum of 10.0. "Certain ASUS router models have...
The vulnerability of the Siemens RUGGEDCOM CROSSBOW secure access control system allows a intruder to execute arbitrary code.
The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system lies in the deficiencies of its authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created malware files from a remote location...
ZKTeco Biometric System Found Vulnerable to 24 Critical Security Flaws
An analysis of a hybrid biometric access system from Chinese manufacturer ZKTeco has uncovered two dozen security flaws that could be used by attackers to defeat authentication, steal biometric data, and even deploy malicious backdoors. "By adding random user data to the database or using a fake ...
The vulnerability of Acquia DAM, a platform for organizing and managing digital assets, stems from lack of access control. This allows attackers to trigger service interruptions.
The vulnerability of Acquia DAM, a platform for organizing and managing digital assets, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service interruptions...
