Microsoft Rolls Out Patches for 73 Flaws, Including 2 Windows Zero-Days

Microsoft has released patches to address 73 security flaws spanning its software lineup as part of its Patch Tuesday updates for February 2024, including two zero-days that have come under active exploitation. Of the 73 vulnerabilities, 5 are rated Critical, 65 are rated Important, and three and...

The vulnerability of the printer troubleshooting tool from Microsoft, which addresses errors in printer functionality due to insufficient input data verification, allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Printer Metadata Troubleshooter Tool relates to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerability of microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA flow gas analyzers is related to deficiencies in authentication procedures. This allows attackers to compromise data integrity and cause service failures.

The vulnerability of the microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA gas analyzers is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to compromise data integrity and cause service failures...

The vulnerability of the application-collabora office package of the XWiki Platform, a platform for creating collaborative web applications. This vulnerability allows an attacker to open arbitrary Office attachments during viewing or editing mode.

The vulnerability of the application-collabora office package of the XWiki Platform, a platform for creating collaborative web applications, is related to errors in the use of standard permissions. Exploiting this vulnerability allows a malicious actor to open arbitrary Office attachments during...

PT-2024-11954

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A heap overflow occurs in the SMM System Management Mode module. An attacker who possesses a second vulnerability allowing writes to the SPI Serial Peripheral...

WordPress Plugin Bold Page Builder Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

The vulnerability of the ActivityPub plugin in the WordPress content management system allows attackers to perform unauthorized functions, modify or delete any content.

The vulnerability of the ActivityPub plugin in the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to perform unauthorized functions, modify or delete arbitrary content...

The vulnerability of the PayDroid operating system arises from insufficient validation of input data, allowing a hacker to execute arbitrary code.

The vulnerability of the PayDroid operating system exists due to insufficient checks on input data. Exploiting this vulnerability could allow a hacker to execute arbitrary code...

Zyxel zysh Format String Proof Of Concept

!/usr/bin/expect -f raptorzyshfhtagn.exp - zysh format string PoC exploit Copyright c 2022 Marco Ivaldi "We live on a placid island of ignorance in the midst of black seas of infinity, and it was not meant that we should voyage far." -- H. P. Lovecraft, The Call of Cthulhu "Multiple improper inpu...

The vulnerability of the IPv6 Handler component in the D-Link R15 network device’s microprogramming software allows a hacker to gain unauthorized access to arbitrary services.

The vulnerability of the IPv6 Handler component in the D-Link R15 network device software is related to access control deficiencies. Exploiting this vulnerability could allow an attacker to gain unauthorized access to arbitrary services...

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

Cisco, Fortinet, and VMware have released security fixes for multiple security vulnerabilities, including critical weaknesses that could be exploited to perform arbitrary actions on affected devices. The first set from Cisco consists of three flaws – CVE-2024-20252 and CVE-2024-20254 CVSS score:...

Critical Boot Loader Vulnerability in Shim Impacts Nearly All Linux Distros

The maintainers of shim have released version 15.8 to address six security flaws, including a critical bug that could pave the way for remote code execution under specific circumstances. Tracked as CVE-2023-40547 CVSS score: 9.8, the vulnerability could be exploited to achieve a Secure Boot bypas...

USN-6610-2 firefox regressions

USN-6610-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potential...

Vulnerability of the Server component: The Optimizer component of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component of the database management system’s optimizer is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems regarding network devices from Qnap, related to authentication procedures that allow attackers to compromise the target system.

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems for QNAP network devices is related to authentication procedures’ flaws. Exploiting this vulnerability allows a malicious actor to compromise the target system remotely...

The vulnerability of the Setup sub-component, part of the Admin component in Oracle Knowledge Management, a system for automating business processes within the Oracle E-Business Suite, allows an attacker to gain access to read, modify, add, or delete data.

The vulnerability of the Setup sub-component and the Admin component of Oracle Knowledge Management, a system for automating business processes within the Oracle E-Business Suite, exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating...

WordPress plugin ProfilePress security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

The vulnerability of the Jenkins GitLab Branch Source Plugin, related to deficiencies in authentication procedures, allows attackers to gain unauthorized access to confidential information.

The vulnerability of the Jenkins GitLab Branch Source Plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to confidential information...

The vulnerabilities of microprogramming software in FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi systems allow a intruder to gain unauthorized access to protected information, execute arbitrary code, and gain full control over the device.

The vulnerability of the microprogramming software in FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi systems is related to the absence of authentication procedures for critical functions. Exploiting this vulnerability could allow an attacker to gain unauthorized...

The vulnerabilities of the microprogramming software for thermal scanning systems—FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi system for centralized data storage and management—allow a intruder to execute arbitrary commands or trigger failures.

The vulnerabilities of the microprogramming software for thermal scanning systems—FeverWarn ESP32, FeverWarn RaspberryPi, and the FeverWarn DataHub RaspberryPi system for centralized data storage and management—are related to insufficient validation of input data. Exploiting these vulnerabilities...