Researchers Uncover Hijack Loader Malware Using Stolen Code-Signing Certificates

Cybersecurity researchers have disclosed a new malware campaign that delivers Hijack Loader artifacts that are signed with legitimate code-signing certificates. French cybersecurity company HarfangLab, which detected the activity at the start of the month, said the attack chains aim to deploy an...

CVE-2024-9952

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=systeminfo/contactinfo of the component Contact Information Page. The manipulation of the argument Address leads to cross site...

SourceCodester Online Eyewear Shop Cross-site Script Vulnerability

SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A cross-site scripting vulnerability exists in...

Cloudlog security vulnerabilities

Cloudlog is a self-hosted PHP application by the individual developer Peter Goodhall. Allows logging of amateur radio contacts from anywhere. A security vulnerability exists in Cloudlog version 2.6.15 that stems from allowing SQL injection via the stationid parameter of Oqrs.php getstationinfo...

PT-2024-33059

Name of the Vulnerable Software and Affected Versions Cloudlog version 2.6.15 Description The issue is related to a SQL injection vulnerability in the Oqrs.php endpoint, specifically affecting the get station info function when the station id parameter is used. This vulnerability can be exploited...

PT-2024-33908

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A kernel-infoleak issue has been identified in the Linux kernel, specifically in the con font get function. The font.data may not initialize all memory spaces, depending on the...

PT-2024-39824 · Tungsten Automation · Tungsten Automation Power Pdf

Name of the Vulnerable Software and Affected Versions: Tungsten Automation Power PDF affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where the target must visit a malicious...

CLSA-2024-1728581726 linux-firmware: Fix of CVE-2023-31315

Update AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A10F12ver:0x0A101248, cpuid:0x00AA0F02ver:0x0AA00215, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A10F11ver:0x0A101148, cpuid:0x00A00F11ver:0x0A0011D5; - Update AMD CPU microcode for processor family 0x17:...

CLSA-2024-1728581276 linux-firmware: Fix of CVE-2023-31315

Update AMD CPU microcode for processor family 0x19: cpuid:0x00A00F10ver:0x0A00107A, cpuid:0x00A10F12ver:0x0A101248, cpuid:0x00AA0F02ver:0x0AA00215, cpuid:0x00A00F12ver:0x0A001238, cpuid:0x00A10F11ver:0x0A101148, cpuid:0x00A00F11ver:0x0A0011D5; - Update AMD CPU microcode for processor family 0x17:...

CVE-2024-47671

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: prevent kernel-usb-infoleak The syzbot reported a kernel-usb-infoleak in usbtmcwrite, we need to clear the structure before filling fields...

AZL-50812 CVE-2024-47671 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: prevent kernel-usb-infoleak The syzbot reported a kernel-usb-infoleak in usbtmcwrite, we need to clear the structure before filling fields...

CVE-2024-9671

A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed...

PT-2024-32533 · Unknown · Ws Form Lite

Name of the Vulnerable Software and Affected Versions: WS Form LITE versions 1.9.238 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For WS Fo...

CVE-2024-47616

The CVE-2024-47616 issue affects Pomerium’s databroker service. Incomplete validation of JWTs could cause databroker API authorization to accept some service account tokens that are still valid, enabling exfiltration of user info, session spoofing, or tampering with Pomerium routes, policies, and...

Malicious code in cookie_info (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f3a1b3ca5e526deb6d9a3b3dcb7b1282b006b8b1cf445c9c1b824162b719d26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45408

eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authenticated user to access several kinds of otherwise restricted information. If anonymous access is allowed something disabled by default, this extends to anyon...

CVE-2024-7432

creationtimestamp| type| source ---|---|--- 2024-10-01 11:04:08+00:00| seen| https://t.me/cvedetector/6724 2026-07-06 18:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mpyqbutx6r23...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

PT-2024-31877 · Cloudlog · Cloudlog

Name of the Vulnerable Software and Affected Versions: Cloudlog version 2.6.15 Description: A SQL Injection issue was discovered, specifically within the get station info function located in the file /application/models/Oqrs model.php. The issue is exploitable via the station id parameter. This...

PT-2024-32085 · Inroad · Inroad

Name of the Vulnerable Software and Affected Versions: INROAD versions prior to v202402060 Description: The issue concerns the API endpoint "/AccountMaster/GetCurrentUserInfo" where attackers can access sensitive information by sending a crafted payload to the UserNameOrPhoneNumber parameter. Thi...