USN-6726-2: Linux kernel (IoT) vulnerabilities

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service host domain crash...

PT-2024-4884 · Oracle · Oracle Commerce Platform

Name of the Vulnerable Software and Affected Versions: Oracle Commerce Platform versions 11.3.0 through 11.3.2 Description: The issue is related to insufficient input validation in the Oracle Commerce Platform, allowing an unauthenticated attacker with network access via HTTP to compromise the...

PT-2024-4764 · Энтек · Энтек

Name of the Vulnerable Software and Affected Versions: ЭНТЕК affected versions not specified Description: The issue is related to the use of flawed cryptographic algorithms in the SCADA system, which could allow an attacker to gain unauthorized access to protected information. Recommendations: At...

Concrete CMS 9.2.7 Cross Site Scripting / Open Redirect Vulnerabilities

Concrete CMS version 9.2.7 suffers from information disclosure, open redirection, and persistent cross site scripting vulnerabilities. Exploit Title: Multiple Web Flaws in concretecmsv9.2.7 Exploit Author: Andrey Stoykov Version: 9.2.7 Tested on: Ubuntu 22.04 Blog: http://msecureltd.blogspot.com...

PT-2024-22676 · Xibo · Xibo

Name of the Vulnerable Software and Affected Versions: Xibo versions prior to 3.3.10 Xibo versions prior to 4.0.9 Xibo version 1.8 Xibo version 2.3 Description: Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected...

The vulnerability of the Intel oneAPI Toolkit, a collection of software development tools, is related to deficiencies in access control. This vulnerability allows attackers to trigger a service failure.

The vulnerability of the Intel oneAPI Toolkit software development tools is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to trigger a service failure...

Concrete CMS 9.2.7 Cross Site Scripting / Open Redirect

Exploit Title: Multiple Web Flaws in concretecmsv9.2.7 Date: 4/2024 Exploit Author: Andrey Stoykov Version: 9.2.7 Tested on: Ubuntu 22.04 Blog: http://msecureltd.blogspot.com Verbose Error Message - Stack Trace: 1. Directly browse to edit profile page 2. Error should come up with verbose stack...

GHSA-J5VM-7QCC-2WWG vulnerabilities

Vulnerabilities for packages: kots...

Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero-Days Included

Microsoft has released security updates for the month of April 2024 to remediate a record 149 flaws, two of which have come under active exploitation in the wild. Of the 149 flaws, three are rated Critical, 142 are rated Important, three are rated Moderate, and one is rated Low in severity. The...

The software for remote control of computers by TeamViewer on macOS has vulnerabilities related to error handling of links, which allows attackers to escalate their privileges or cause service failures.

The vulnerability of TeamViewer’s remote control software for macOS is related to errors in URL processing. Exploiting this vulnerability can allow attackers to gain increased privileges or cause service interruptions...

The vulnerability of microprogramming software for Intel Optane PMem 100 Series persistent memory modules, related to access segmentation deficiencies, allows attackers to exploit their privileges.

The vulnerability of microprogramming software for Intel Optane PMem 100 Series persistent memory modules is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Windows operating system proxy server driver allows a hacker to execute arbitrary code.

The vulnerability of Windows operating system proxy server drivers is related to access control errors. Exploiting this vulnerability allows an attacker to execute arbitrary code by replacing the proxy server driver...

Researchers Discover LG Smart TV Vulnerabilities Allowing Root Access

Multiple security vulnerabilities have been disclosed in LG webOS running on its smart televisions that could be exploited to bypass authorization and gain root access on the devices. The findings come from Romanian cybersecurity firm Bitdefender, which discovered and reported the flaws in Novemb...

Ivanti Addresses Flaws Leading to DoS Attacks and Code Execution

...

The vulnerability of the microprogramming-based BIOS software on Server Board S1200RP, S1400FP, S1400SP, S1600JP, S2400BB, S2400EP, S2400SC, S2600CO, S2600CP, S2600GL, S2600GZ, S2600IP, W2600CR, S2600JF, S2600WP, S4600LH, S4600LT, S2600CW, S2600KP, S2600TP, and S2600WT boards is related to access control deficiencies, which allow attackers to increase their privileges.

The vulnerability of the microprogramming-based BIOS software on Server Board S1200RP, S1400FP, S1400SP, S1600JP, S2400BB, S2400EP, S2400SC, S2600CO, S2600CP, S2600GL, S2600GZ, S2600IP, W2600CR, S2600JF, S2600WP, S4600LH, S4600LT, S2600CW, S2600KP, S2600TP, and S1200BT is related to access contro...

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar lies in its authentication procedures’ deficiencies, which allow attackers to alter arbitrary storage settings, TTL values, and download configurations.

The vulnerability of the cloud-based messaging and streaming transmission platform Apache Pulsar is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to alter arbitrary storage settings, TTL values, and download configurations...

The vulnerability of the control interface of the MyQ Print Server allows a hacker to execute arbitrary code.

The vulnerability of the MyQ Print Server’s management interface is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the mDNS gateway function in Cisco IOS XE wireless controller Catalyst Series 9800 allows a attacker to cause a service failure.

The vulnerability of the multicast DNS mDNS function in Cisco IOS XE wireless controller Catalyst Series 9800 devices is related to incomplete cleanup of temporary or auxiliary resources during the processing of mDNS requests. Exploiting this vulnerability allows a malicious actor to cause servic...

The vulnerability of Microsoft Edge browser on Android, related to access control deficiencies, allows attackers to circumvent existing security restrictions.

The vulnerability of Microsoft Edge browser on Android is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

Ivanti Rushes Patches for 4 New Flaws in Connect Secure and Policy Secure

Ivanti has released security updates to address four security flaws impacting Connect Secure and Policy Secure Gateways that could result in code execution and denial-of-service DoS. The list of flaws is as follows - CVE-2024-21894 CVSS score: 8.2 - A heap overflow vulnerability in the IPSec...