9213 matches found
QNAP Multiple Product Security Vulnerabilities
QNAP Systems QuTScloud and others are products of China Weilian Technology QNAP Systems.QNAP Systems QuTScloud is a cloud-optimized version of the QNAP NAS operating system.QNAP Systems QTS is an operating system for entry- to mid-range QNAP NAS use. QNAP Systems QuTS hero is an operating system....
Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities
Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices. This includes custom web shells such as BUSHWALK,...
RunC Flaws Enable Container Escapes, Granting Attackers Host Access
Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have...
Alert: Ivanti Discloses 2 New Zero-Day Flaws, One Under Active Exploitation
Ivanti is alerting of two new high-severity flaws in its Connect Secure and Policy Secure products, one of which is said to have come under targeted exploitation in the wild. The list of vulnerabilities is as follows - CVE-2024-21888 CVSS score: 8.8 - A privilege escalation vulnerability in the w...
Critical Flaws Found in GNU C Library, Major Linux Distros at Risk
By Deeba Ahmed Patch Now or Pay Later: Qsort Flaw Leaves Millions of Linux Systems Exposed. This is a post from HackRead.com Read the original post: Critical Flaws Found in GNU C Library, Major Linux Distros at Risk...
Hackers Exploiting Ivanti VPN Flaws to Deploy KrustyLoader Malware
A pair of recently disclosed zero-day flaws in Ivanti Connect Secure ICS virtual private network VPN devices have been exploited to deliver a Rust-based payload called KrustyLoader that's used to drop the open-source Sliver adversary simulation tool. The security vulnerabilities, tracked as...
WordPress plugin Contact Form Entries Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...
Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7
The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...
USN-6617-1 libde265 vulnerabilities
It was discovered that libde265 could be made to write out of bounds. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and...
Mozilla: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7
The Mozilla Foundation Security Advisory describes this flaw as: Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...
Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws
Juniper Networks has released out-of-band updates to address high-severity flaws in SRX Series and EX Series that could be exploited by a threat actor to take control of susceptible systems. The vulnerabilities, tracked as CVE-2024-21619 and CVE-2024-21620, are rooted in the J-Web component and...
Vulnerability of the Server component: The Oracle MySQL Server component of the RAPID database management system, which allows a hacker to cause a service failure.
The vulnerability of the Oracle MySQL Server component of the RAPID database management system is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions remotely...
The vulnerability of the Mozilla Firefox browser, related to deficiencies in access control, allows a hacker to insert any arbitrary URI into the address bar or browser history.
The vulnerability of the Mozilla Firefox browser is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to specify arbitrary URIs in the address bar or browser history...
The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, related to deficiencies in access control, allows attackers to carry out spear-phishing attacks.
The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to deficiencies in access control. Exploiting these vulnerabilities can allow attackers to carry out spear-phishing attacks remotely...
Vulnerability of the Server component: The Oracle MySQL Server database management system’s options, which allow a hacker to cause a service failure.
Vulnerability of the Server component: The Oracle MySQL Server component of the database management system has vulnerabilities related to insufficient validation of input data. Exploiting these vulnerabilities can allow attackers to cause service interruptions...
The vulnerability of the chroot environment manager used for creating RPM packages for Mock allows for arbitrary code execution due to insufficient input validation.
The vulnerability of the chroot environment manager used for creating RPM packages for Mock is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2024-1115)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OpenText AppBuilder Security Vulnerability
OpenText AppBuilder is an application from OpenText Canada. A security vulnerability exists in OpenText AppBuilder versions 21.2 through 23.2 that originates from incorrect input validation and allows probing of system files...
Improper Access Control
GitLab is vulnerable to Improper Access Control. The vulnerability is caused due to flaws in the implementation of access controls mechanism.This allows an attacker to create a workspace in one group that is associated with an agent from another group...
Critical Jenkins Vulnerability Exposes Servers to RCE Attacks - Patch ASAP!
The maintainers of the open-source continuous integration/continuous delivery and deployment CI/CD automation software Jenkins have resolved nine security flaws, including a critical bug that, if successfully exploited, could result in remote code execution RCE. The issue, assigned the CVE...