8964 matches found
The vulnerability of the Music component in operating systems such as macOS, iPadOS, and iOS allows attackers to gain increased privileges.
The vulnerability of the Music component in operating systems such as macOS, iPadOS, and iOS is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
The vulnerability of the Infrastructure component of Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) allows a attacker to gain read, modify, or delete access to data, or cause a service failure.
The vulnerability of the Infrastructure component of the Oracle Financial Services Analytical Applications Infrastructure OFSAAI business analytics platform is related to insufficient validation of input data. Exploitation of this vulnerability could allow a malicious actor to gain read, modify, ...
Fujitsu Bugs That Sent Innocent People to Prison Were Known ‘From the Start’
Software flaws were allegedly hidden from lawyers of wrongly convicted UK postal workers...
Chinese Hackers Silently Weaponized VMware Zero-Day Flaw for 2 Years
An advanced China-nexus cyber espionage group previously linked to the exploitation of security flaws in VMware and Fortinet appliances has been attributed to the abuse of a critical vulnerability in VMware vCenter Server as a zero-day since late 2021. "UNC3886 has a track record of utilizing...
SUSE-SU-2024:0156-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unixstreamreadgenericon the socket that t...
Citrix Warns of Critical Netscaler Flaws Actively Exploited in Attacks – Urges Immediate Patching
Summary: Two zero-day security vulnerabilities, identified as CVE-2023-6548 and CVE-2023-6549, have been discovered in NetScaler ADC and NetScaler Gateway. These vulnerabilities are actively exploited in the wild. CVE-2023-6548 affects the NetScaler management interface, potentially leading to...
PixieFail UEFI Flaws Expose Millions of Computers to RCE, DoS, and Data Theft
Multiple security vulnerabilities have been disclosed in the TCP/IP network protocol stack of an open-source reference implementation of the Unified Extensible Firmware Interface UEFI specification used widely in modern computers. Collectively dubbed PixieFail by Quarkslab, the nine issues reside...
The vulnerability of the `sysScheduleRebootSet` function in the wireless access point software of Tenda i29 allows a intruder to execute arbitrary code.
The vulnerability of the sysScheduleRebootSet function in the wireless access point software of Tenda i29 involves insufficient measures taken to protect input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerabilities of microprogramming software in AMD, Qualcomm, and Imagination allow attackers to extract data from the local memory of GPUs.
The vulnerabilities of microprogramming software for AMD, Qualcomm, and Imagination relate to insufficient isolation of the GPU’s local memory, as well as the lack of cleanup after processes are executed on the GPU. Exploiting these vulnerabilities can allow attackers to extract data from the GPU...
Feds Warn of AndroxGh0st Botnet Targeting AWS, Azure, and Office 365 Credentials
The U.S. Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI warned that threat actors deploying the AndroxGh0st malware are creating a botnet for "victim identification and exploitation in target networks." A Python-based malware, AndroxGh0st was fir...
The vulnerability of the ResponseParser method in Inductive Automation Ignition’s software for industrial automation allows a perpetrator to execute arbitrary code.
The vulnerability of the ResponseParser method in Inductive Automation Ignition software relates to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...
The vulnerability of the web components of Ivanti Connect Secure and Ivanti Policy Secure control tools allows a intruder to gain unauthorized access to protected information.
The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure web components related to authentication procedures’ flaws. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information by sending specially crafted requests...
The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma, related to deficiencies in HTTP request processing, allows attackers to induce service failures.
The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to induce service failures through specially crafted HTTP requests HTTP Request Smuggling attacks...
Ivanti VPN Zero-Day Flaws Fuel Widespread Cyber Attacks
By Deeba Ahmed Another day, another zero-day flaw driving the cybersecurity world crazy. This is a post from HackRead.com Read the original post: Ivanti VPN Zero-Day Flaws Fuel Widespread Cyber Attacks...
kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route
There are 3 CVEs for the use-after-free flaw found in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system...
kernel: net/sched: Use-after-free vulnerabilities in the net/sched classifiers: cls_fw, cls_u32 and cls_route
There are 3 CVEs for the use-after-free flaw found in net/sched/clsfw.c in classifiers clsfw, clsu32, and clsroute in the Linux Kernel: CVE-2023-4206, CVE-2023-4207, CVE-2023-4208. A local user could use any of these flaws to crash the system or potentially escalate their privileges on the system...
Alert: Over 178,000 SonicWall Firewalls Potentially Vulnerable to Exploits - Act Now
Over 178,000 SonicWall firewalls exposed over the internet are exploitable to at least one of the two security flaws that could be potentially exploited to cause a denial-of-service DoS condition and remote code execution RCE. "The two issues are fundamentally the same but exploitable at differen...
The vulnerability of the ExtendedDocumentCodec class in the industrial automation software suite Inductive Automation Ignition allows a perpetrator to execute arbitrary code.
The vulnerability of the ExtendedDocumentCodec class in Inductive Automation Ignition software relates to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Two Zero-Day Flaws Found in Ivanti Connect Secure and Policy Secure
Summary: The active exploitation of zero-day vulnerabilities CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure gateways presents a serious threat, allowing unauthorized remote code execution. The actor, recognized as the Chinese nation-state-level entity UTA0178,...
The vulnerability of the Common Log File System (CLFS) log management subsystem in Windows operating systems allows attackers to escalate their privileges.
The vulnerability of the Common Log File System CLFS log management subsystem in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...