17766 matches found
CVE-2024-36950
In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until busresetwork has serviced and cleared the...
CVE-2024-4741
A use-after-free vulnerability was found in OpenSSL. Calling the OpenSSL API SSLfreebuffers function may cause memory to be accessed that was previously freed in some situations. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat...
Hackers Claim Ticketmaster Data Breach: 560M Users’ Info for Sale at $500K
By Waqas ShinyHunters hacking group has claimed to have breached Ticketmaster, stealing the personal data of 560 million users. The… This is a post from HackRead.com Read the original post: Hackers Claim Ticketmaster Data Breach: 560M Users Info for Sale at $500K...
CVE-2024-36112
CVE-2024-36112 affects Nautobot: in 1.3.0–1.6.22 and 2.0.0–2.2.4, listing members of Dynamic Groups via the UI or API does not enforce member-object permissions, enabling a user with extras.view_dynamicgroup to see all Group members regardless of dcim.view_device. Fixed in Nautobot 1.6.23 and 2.2...
CVE-2024-23580
The CVE-2024-23580 entry concerns HCL DRYiCE Optibot Reset Station. Affected component: the OTP handling/encryption mechanism, where insecure encryption could allow an attacker with database access to recover some or all encrypted OTP values. Documented impact focuses on confidentiality (HIGH) wi...
GHSA-8FMJ-33GW-G7PW Denial of service of Minder Server from maliciously crafted GitHub attestations
Minder is vulnerable to a denial-of-service DoS attack which could allow an attacker to crash the Minder server and deny other users access to it. The root cause of the vulnerability is that Minders sigstore verifier reads an untrusted response entirely into memory without enforcing a limit on th...
CVE-2024-30212 Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
If a SCSI READ10 command is initiated via USB using the largest LBA 0xFFFFFFFF with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM can be exposed. The same method works to wri...
CVE-2024-33805
The campcodes Complete Web-Based School Management System version 1.0 is vulnerable to a SQL injection flaw located in the /model/get_student.php API endpoint. An attacker can exploit this vulnerability by providing malicious input via the id parameter to execute arbitrary SQL commands. Practical...
CVE-2024-5411
creationtimestamp| type| source ---|---|--- 2024-05-28 13:37:59+00:00| seen| https://t.me/HackingInsights/1004 2025-02-13 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-15...
Trusted relationship attacks: trust, but verify
IT outsourcing market continues to demonstrate strong growth globally – such services are becoming increasingly popular. But along with the advantages, such as saved time and resources, delegating non-core tasks creates new challenges in terms of information security. By providing third-party...
Oracle Linux 8 : libsndfile (ELSA-2024-3030)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3030 advisory. 1.0.28-14 - fix integer overflows causing CVE-2022-33065 RHEL-3750 Tenable has extracted the preceding description block directly from the Oracle Linux security...
GHSA-PH62-FV59-VF9H silverstripe/framework users inadvertently passing sensitive data to LoginAttempt
All user login attempts are logged in the database in the LoginAttempt table. However, this table contains information in plain text, and may possible contain sensitive information, such as user passwords mis-typed into the username field. In order to address this a one-way hash is applied to the...
CVE-2024-5274
creationtimestamp| type| source ---|---|--- 2024-05-24 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1302 2024-05-24 12:15:54+00:00| exploited| https://t.me/thehackernews/5009 2024-05-24 12:27:55+00:00| exploited| https://t.me/informationsecuritychannel/52259 2024-05-24...
CVE-2021-47286
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: core: Validate channel ID when processing command completions MHI reads the channel ID from the event ring element sent by the device which can be any value between 0 and 255. In order to prevent any out of bound...
CLOUD#REVERSER: From Cloud Storage to Command and Control
...
Requests `Session` object does not verify requests after making first request with verify=False
...
BELL-CVE-2023-52802
Bulletin has no description...
Certain HP LaserJet Pro Printers – Potential Information Disclosure
A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By redirecting send-to-email traffic to the new server, the original SMTP server credentials may potentially be exposed. Update your printer...
