BIT-PARSE-2023-46119 Parse Server may crash when uploading file without extension

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1...

BIT-MYSQL-SHELL-2022-21535

Vulnerability in the MySQL Shell product of Oracle MySQL component: Shell: General/Core Client. Supported versions that are affected are 8.0.28 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Shell executes to compromise...

BIT-MYSQL-SHELL-2022-21555

Vulnerability in the MySQL Shell for VS Code product of Oracle MySQL component: Shell: GUI. Supported versions that are affected are 1.1.8 and prior. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Shell for VS Code executes to...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, terraform-provider-sendgrid, helm-push, pulumi-language-java, gomplate, cfssl, kubeflow, guac, crossplane-provider-family-aws, crossplane-provider-aws-firehose, src, prometheus-pushgateway, restic, crossplane-provider-aws-cloudformation,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: controller-gen, helm-push, pulumi-language-java, nri-kafka, gomplate, cfssl, newrelic-fluent-bit-output, src, prometheus-pushgateway, k8ssandra-operator, fuse-overlayfs-snapshotter, gosu, nri-prometheus, task, flannel-cni-plugin, gitness, kine, flux, eksctl,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: controller-gen, helm-push, pulumi-language-java, nri-kafka, gomplate, cfssl, newrelic-fluent-bit-output, src, prometheus-pushgateway, k8ssandra-operator, fuse-overlayfs-snapshotter, gosu, nri-prometheus, task, flannel-cni-plugin, gitness, kine, flux, eksctl,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: controller-gen, helm-push, pulumi-language-java, nri-kafka, gomplate, cfssl, newrelic-fluent-bit-output, src, prometheus-pushgateway, k8ssandra-operator, fuse-overlayfs-snapshotter, gosu, nri-prometheus, task, flannel-cni-plugin, gitness, kine, flux, eksctl,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: controller-gen, helm-push, pulumi-language-java, nri-kafka, gomplate, cfssl, newrelic-fluent-bit-output, src, prometheus-pushgateway, k8ssandra-operator, fuse-overlayfs-snapshotter, gosu, nri-prometheus, task, flannel-cni-plugin, gitness, kine, flux, eksctl,...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 3 (6.0.1-89)

This update provides stability improvements. Vulnerability id: VSTOR-82695 Deploying a Kubernetes cluster may take longer than expected. Vulnerability id: VSTOR-82730 Restarting libvirtd causes EFI VMs to reboot...

Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure

U.S. cybersecurity and intelligence agencies have warned of Phobos ransomware attacks targeting government and critical infrastructure entities, outlining the various tactics and techniques the threat actors have adopted to deploy the file-encrypting malware. "Structured as a ransomware as a...

CISA, FBI, and MS-ISAC Release Advisory on Phobos Ransomware

Today, CISA, the Federal Bureau of Investigation FBI, and the Multi-State Information Sharing and Analysis Center MS-ISAC released a joint Cybersecurity Advisory CSA, StopRansomware: Phobos Ransomware, to disseminate known tactics, techniques, and procedures TTPs and indicators of compromise IOCs...

Delta Electronics CNCSoft-B

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Delta Electronics Equipment : CNCSoft-B Vulnerability : Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3...

kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c

A flaw was found in the Linux kernel Direct Rendering Infrastructure DRI subsystem in which a use-after-free can be caused when a user triggers a race condition between a nonblocking atomic commit and a driver unload. A local user could use this flaw to crash the system or potentially escalate...

Unmasking Doppelgänger: Russia’s Disinformation Campaign Revealed

Summary: Doppelgänger, a suspected Russia-aligned influence operation network targeting German audiences with propaganda and disinformation, potentially aiming to sway opinions ahead of elections. Doppelgänger employs coordinated social media activities and a dynamic infrastructure to maximize it...

The vulnerability of the /usr/local/nagios/bin/npcd component, a monitoring tool for IT infrastructure, allows a attacker to elevate their privileges to the root level.

The vulnerability of the /usr/local/nagios/bin/npcd component of the Nagios XI IT infrastructure monitoring tool exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to elevate their privileges to the root...

The vulnerability of the monitoringwizard.php file, a monitoring tool for IT infrastructure, allows a malicious actor to execute arbitrary SQL queries.

The vulnerability of the monitoringwizard.php file, a tool for monitoring IT infrastructure, relates to the possibility of embedding commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

SVR Cyber Actors Adapt Tactics for Initial Cloud Access

How SVR-Attributed Actors are Adapting to the Move of Government and Corporations to Cloud Infrastructure OVERVIEW This advisory details recent tactics, techniques, and procedures TTPs of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes, or Cozy Bear. The UK National...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 2 (6.0.1-88)

This update provides stability improvements. Vulnerability id: VSTOR-80869 Snapshot creation for volumes stored on external NFS may fail under certain circumstances. Vulnerability id: VSTOR-81489 Some requests to the S3 service may fail with the 504 HTTP error. Vulnerability id: VSTOR-81846 Fixed...

PT-2024-15574 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: AnythingLLM affected versions not specified Description: The issue allows users with proper authorization levels manager, admin, and when in single user mode to access sensitive information by using a web scraper to query a specific URL:...

CISA, EPA, and FBI Release Top Cyber Actions for Securing Water Systems

Today, CISA, the Environmental Protection Agency EPA, and the Federal Bureau of Investigation FBI released the joint fact sheet Top Cyber Actions for Securing Water Systems. This fact sheet outlines the following practical actions Water and Wastewater Systems WWS Sector entities can take to bette...