Oracle VM VirtualBox 安全漏洞

Oracle VM VirtualBox is a virtual machine management software from Oracle Corporation USA. A security vulnerability exists in Oracle VM VirtualBox version 7.1.6, which originates from an elevated-privilege attacker that can be exploited via the login infrastructure and could lead to unauthorized...

Exploit for Uncontrolled Resource Consumption in Ietf Http

PoC - CVE-2023-44487: HTTP/2 Rapid Reset Attack Este reposito...

China Sort of Admits to Being Behind Volt Typhoon

The Wall Street Journal has the story: Chinese officials acknowledged in a secret December meeting that Beijing was behind a widespread series of alarming cyberattacks on U.S. infrastructure, according to people familiar with the matter, underscoring how hostilities between the two superpowers ar...

CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide

Despite their hacktivist front, CyberAv3ngers is a rare state-sponsored hacker group bent on putting industrial infrastructure at risk—and has already caused global disruption...

Vulnerability of the meson_probe_remote() function in the drivers/gpu/drm/meson/meson_drv.c module – This driver provides support for the Direct Rendering Infrastructure (DRI) of the Linux operating system, allowing an attacker to cause a service failure.

Vulnerability of the mesonproberemote function in the drivers/gpu/drm/meson/mesondrv.c module – The driver for supporting Direct Rendering Infrastructure DRI in Linux kernels is vulnerable due to a NULL pointer dereferencing issue. Exploiting this vulnerability could allow an attacker to cause a...

Vulnerability of the get_firmware_info_v3_2() function in the drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c module – A driver for supporting Direct Rendering Infrastructure (DRI) in AMD graphics cards for Linux operating systems, which allows a hacker to cause a service failure.

Vulnerability of the getfirmwareinfov32 function in the drivers/gpu/drm/amd/display/dc/bios/biosparser2.c module – The driver that supports Direct Rendering Infrastructure DRI for AMD graphics cards in Linux operating systems is vulnerable due to a NULL pointer dereferencing issue. Exploiting thi...

Vulnerability of the set_wm_ranges() function in the drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c file – This function is part of the driver support for Direct Rendering Infrastructure (DRI) of AMD graphics cards in Linux operating systems. It can be exploited by attackers to cause service failures.

Vulnerability of the setwmranges function in the drivers/gpu/drm/amd/display/dc/dcn301/dcn301resource.c file – The drivers for AMD graphics cards that support Direct Rendering Infrastructure DRI in Linux operating systems are vulnerable due to improper control of resource identifiers “resource...

Vulnerability of the msm_dsiPhyDriverUnregister() function in the drivers/gpu/drm/msm/dsi/phy/dsiPhy.c module – a driver for supporting Linux’s Direct Rendering Infrastructure (DRI), which allows a hacker to cause a service failure

Vulnerability of the msmdsiPhyDriverUnregister function in the drivers/gpu/drm/msm/dsi/phy/dsiPhy.c module – The driver for Linux’s Direct Rendering Infrastructure DRI architecture is vulnerable due to a NULL pointer dereferencing issue. Exploiting this vulnerability could allow an attacker to...

[SECURITY] Fedora 40 Update: zabbix-6.0.39-1.fc40

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

China Secretly (and Weirdly) Admits It Hacked US Infrastructure

Plus: The Department of Homeland Security begins surveilling immigrants' social media, President Donald Trump targets former CISA director who refuted his claims of 2020 election fraud, and more...

[SECURITY] Fedora 42 Update: zabbix-7.2.5-1.fc42

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

[SECURITY] Fedora 41 Update: zabbix-7.0.11-1.fc41

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechanism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

China-based SMS Phishing Triad Pivots to Banks

China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from Apple and Google. Until recently, the so-called "Smishing Triad " mainly impersonated toll road operators and shipping companies. But experts say these groups a...

CVE-2025-0539

In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allowing a suitably positioned attacker to compromise the account running Octopus Server and potentially the host infrastructure itself...

golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

A flaw was found in the crypto/x509 package of the Golang standard library. A certificate with a URI, which has a IPv6 address with a zone ID, may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI; this...

Videx CyberAudit-Web 安全漏洞

Videx CyberAudit-Web is a software suite from Videx for managing Cyberlock systems of all sizes. A security vulnerability exists in Videx CyberAudit-Web versions prior to 1.1.3 that stems from server-side request forgery and could lead to unauthorized access to infrastructure...

Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks

A previously disclosed vulnerability in NVIDIA Container Toolkit has an incomplete patch, which, if exploited, could put a wide range of AI infrastructure and sensitive data at risk...

Octopus Deploy 安全漏洞

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Australia. A security vulnerability exists in Octopus Deploy that stems from the fact that the server can be induced to send requests containing authentication material, which could...

USN-7429-2 linux-fips vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Drivers core; - HID subsystem; - Network drivers; - SCSI subsystem; - SuperH / SH-Mobile drivers; - File systems...

USN-7428-2 linux-fips, linux-aws-fips, linux-azure-fips, linux-gcp-fips vulnerabilities

Demi Marie Obenour and Simon Gaiser discovered that several Xen para- virtualization device frontends did not properly restrict the access rights of device backends. An attacker could possibly use a malicious Xen backend to gain access to memory pages of a guest VM or cause a denial of service in...