PT-2024-22140 · Grav · Grav

Name of the Vulnerable Software and Affected Versions: Grav versions prior to 1.7.43 Description: The issue arises due to insufficient permission validation and inadequate file name validation, allowing users who can write a page to use the frontmatter feature. This can lead to remote code...

Hackers Exploit ConnectWise ScreenConnect Flaws to Deploy TODDLERSHARK Malware

North Korean threat actors have exploited the recently disclosed security flaws in ConnectWise ScreenConnect to deploy a new malware called TODDLERSHARK. According to a report shared by Kroll with The Hacker News, TODDLERSHARK overlaps with known Kimsuky malware such as BabyShark and ReconShark...

Important: dnsmasq

Issue Overview: Certain DNSSEC aspects of the DNS protocol in RFC 4035 and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the "KeyTrap" issue. The protocol specification...

The vulnerability of the microprogrammed anti-vandalism network IP station Commend WS203VICM, related to access control deficiencies, allows a intruder to execute arbitrary commands.

The vulnerability of the microprogrammed anti-vandalism network IP station Commend WS203VICM is related to access control deficiencies. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created request...

Arista Networks Edge Threat Management Security Vulnerability

Arista Networks Edge Threat Management is a network security solution from Arista Networks, Inc. Arista Networks Edge Threat Management has a security vulnerability that stems from the presence of multiple SQL injection vulnerabilities. An attacker could exploit the vulnerability to elevate...

CVE-2023-28512

IBM Watson CP4D Data Stores 4.6.0, 4.6.1, and 4.6.2 could allow an attacker with specific knowledge about the system to manipulate data due to improper input validation. IBM X-Force ID: 250396...

WordPress Plugin Email Encoder Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

The vulnerability of the monitoring tool for VMware Aria Operations, related to deficiencies in access control, allows a perpetrator to escalate their privileges.

The vulnerability of the monitoring tool for VMware Aria Operations is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to enhance their privileges...

The vulnerability of the Microsoft Azure File Sync data synchronization service is related to deficiencies in access control. This allows attackers to circumvent existing security restrictions and enhance their privileges.

The vulnerability of the Microsoft Azure File Sync data synchronization service is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to circumvent existing security restrictions and enhance their privileges...

CentOS 9 : grafana-9.0.9-2.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the grafana-9.0.9-2.el9 build changelog. - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by...

FBI Warns U.S. Healthcare Sector of Targeted BlackCat Ransomware Attacks

The U.S. government is warning about the resurgence of BlackCat aka ALPHV ransomware attacks targeting the healthcare sector as recently as this month. "Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most commonly victimized," the government said in a...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in access control. This allows a malicious individual to alter the headers of deployment keys.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in SSH key management during automated deployment scenarios. Exploiting this vulnerability could allow a malicious actor to modify the headers of deployment private keys...

PT-2024-18358 · Dassault Systèmes · Dassault Systèmes Edrawings

Name of the Vulnerable Software and Affected Versions: Dassault Systèmes eDrawings affected versions not specified Description: The issue allows remote code execution via various file parsing vulnerabilities, including heap-based buffer overflow, memory corruption, out-of-bounds read, out-of-boun...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the authentication process, which allows a malicious individual to alter the settings of the user interface for project management.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to modify the settings of the user interface for project...

USN-6661-1 openjdk-17 vulnerabilities

Yi Yang discovered that the Hotspot component of OpenJDK 17 incorrectly handled array accesses in the C1 compiler. An attacker could possibly use this issue to cause a denial of service, execute arbitrary code or bypass Java sandbox restrictions. CVE-2024-20918 It was discovered that the Hotspot...

The vulnerability of the Task Manager module of the VitalPBX unified communication system allows a hacker to execute arbitrary commands.

The vulnerability of the Task Manager module of the VitalPBX unified communication system is related to errors in access control due to insufficient protection of service data during script processing from the /var/lib/vitalpbx directory. Exploiting this vulnerability allows a remote attacker to...

AnythingLLM Security Vulnerability

AnythingLLM is a business-compliant document chatbot. AnythingLLM has a security vulnerability that stems from the lack of any validation and is capable of including malicious links into submitted document links in the workspace...

The vulnerability of Core Data components in iOS, watchOS, tvOS, iPadOS, macOS operating systems allows attackers to circumvent privacy settings.

The vulnerability of Core Data components in iOS, watchOS, tvOS, iPadOS, and macOS is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to bypass privacy settings...

Joomla! patches XSS flaws that could lead to remote code execution

On February 20, Joomla! posted details about four vulnerabilities it had fixed in its Content Management System CMS, and one in the Joomla! Framework that affects the CMS. Joomla! is an open-source CMS that’s been around since 2005, and has been one of the most popular CMS platforms by market sha...

OESA-2024-1176 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial porti...