CVE-2024-31316

CVE-2024-31316 affects the Android Framework, specifically the onResult path in AccountManagerService.java. The issue is a parcel mismatch that could allow an arbitrary background activity launch, resulting in local elevation of privilege without requiring additional execution privileges. No user...

CVE-2024-23695

CVE-2024-23695 involves the Android/Linux kernel’s CacheOpPMRExec in cache_km.c, with a reported out-of-bounds write caused by an integer overflow. This can lead to local elevation of privilege with no extra execution privileges or user interaction required. The available connected documents do n...

CVE-2023-50805

CVE-2023-50805 affects Samsung Mobile Processor, Wearable Processor, and Modems across Exynos 9820/9825/980/990/850/1080/2100/2200/1280/1380/1330/9110/W920/W930, and Exynos Modem 5123/5300. The vulnerability is an out-of-bounds write in the heap encountered in 2G (no authentication required). Mul...

CVE-2024-28882

OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session...

CVE-2024-28882

OpenVPN OpenVPN 2.6.0–2.6.10 (server role) accepts multiple exit notifications from authenticated clients, which extends the validity of a closing session. This CVE description is consistently echoed across sources (OpenVPN-related advisories in Astra Linux and Alpine Linux pages, Debian security...

CVE-2024-3651

CVE-2024-3651 affects the kjd/idna Python package (python-idna) and specifically the idna.encode() path in version 3.6. The issue arises when processing crafted input strings, causing quadratic growth in CPU load and resulting in a denial of service. Connected sources (Astra Linux, CIRCL, CBLMari...

CVE-2024-33869

An issue was discovered in Artifex Ghostscript before 10.03.1. Path traversal and command execution can occur via a crafted PostScript document because of path reduction in base/gpmisc.c. For example, restrictions on use of %pipe% can be bypassed via the aa/../%pipe%command output filename...

CVE-2024-33871

An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostScript document. This occurs because the Driver parameter for opvp and oprp devices can have an arbitrary name for a...

Warning: Markopolo's Scam Targeting Crypto Users via Fake Meeting Software

A threat actor who goes by alias markopolo has been identified as behind a large-scale cross-platform scam that targets digital currency users on social media with information stealer malware and carries out cryptocurrency theft. The attack chains involve the use of a purported virtual meeting...

OPENSUSE-SU-2024:12597-1 python310-future-0.18.2-4.1 on GA media

These are all security issues fixed in the python310-future-0.18.2-4.1 package on the GA media of openSUSE Tumbleweed...

Medical-Targeted Ransomware Is Breaking Records After Change Healthcare’s $22M Payout

Cybersecurity firm Recorded Future counted 44 health-care-related incidents in the month after Change Healthcare’s payment came to light—the most it’s ever seen in a single month...

CVE-2023-48273

CVE-2023-48273 affects the WordPress plugin Preloader for Website (version

CVE-2023-51682

CVE-2023-51682 : Missing Authorization vulnerability in MC4WP (Mailchimp for WordPress) affecting MC4WP

CVE-2023-52230

CVE-2023-52230 affects Booster Plus for WooCommerce, where versions prior to 7.1.3 expose an authenticated arbitrary WordPress option disclosure due to missing authorization. The issue is a missing authorization vulnerability that could allow a user with at least subscriber privileges to view or ...

Security and Human Behavior (SHB) 2024

This week, I hosted the seventeenth Workshop on Security and Human Behavior at the Harvard Kennedy School. This is the first workshop since our co-founder, Ross Anderson, died unexpectedly. SHB is a small, annual, invitational workshop of people studying various aspects of the human side of...

CVE-2023-49927

CVE-2023-49927 affects Samsung Mobile Processor, Wearable Processor, and Modem Exynos families (980, 990, 850, 1080, 2100, 2200, 1280, 1380, 1330, 9110, W920, and related modems). The baseband software fails to properly validate the RRC format types, leading to insufficient encryption. This is de...

CVE-2023-48276

CVE-2023-48276: WP Forms Puzzle Captcha

CVE-2023-47818

CVE-2023-47818 affects LWS Hide Login (WordPress plugin) up to version 2.1.8. The issue is a protection mechanism bypass that could allow an unauthenticated actor to access login functionality by visiting install.php, effectively bypassing the hidden login protection. Patch/mitigation: upgrade to...

RHEL 7 : future (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server...

6 insights from Microsoft’s 2024 state of multicloud risk report to evolve your security strategy

Multicloud computing has become the foundation for digital businesses, with 86% of organizations having already adopted a multicloud approach.1 However, for all its benefits around increased agility, flexibility, and choice, we also see unique challenges with multicloud—including the need to mana...