Trust Issues in AI

This essay was written with Nathan E. Sanders. It originally appeared as a response to Evgeny Morozov in Boston Review's forum, "The AI We Deserve." For a technology that seems startling in its modernity, AI sure has a long history. Google Translate, OpenAI chatbots, and Meta AI image generators...

Motoko 安全漏洞

Motoko is a secure, simple, participant-based programming language open-sourced by DFINITY for building Internet Computer ICP jar smart contracts. Motoko has a security vulnerability that stems from the incremental garbage collector containing an uninitialized memory access error...

Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059153 fixes several issues. The following security issues were fixed: CVE-2024-36904: tcp: Use refcountincnotzero in tcptwskunique bsc1225733. CVE-2024-43861: Fix memory leak for not ip packets bsc1229553. CVE-2021-47598: schcake: do not call...

OESA-2024-2518 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access to the special register set, Receiver time-out and RHR interrupts can...

Security update for the Linux Kernel (Live Patch 59 for SLE 12 SP5)

This update for the Linux Kernel 4.12.14-122225 fixes one issue. The following security issue was fixed: CVE-2024-43861: Fix memory leak for not ip packets bsc1229553. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

How Holiday Season Traditions Affect Internet Traffic Trends

...

kernel: cifs: fix oops during encryption

An out-of-bounds memory access vulnerability exists in the linux kernel, such that A stack-allocated buffer backed by vmalloc was passed into crypto code scatterwalkmapandcopy → memcpy where a cross-page write occurred. This ended up hitting a read-only mapping, causing a page-level fault and...

Repeat offenders drive bulk of tech support scams via Google Ads

Of all the different kinds of malicious search ads we track, those related to customer service are by far the most common. Brands such as PayPal, eBay, Apple or Netflix are among the most coveted ones as they tend to drive a lot of online searches. Tech support scammers are leveraging Google ads ...

Improper validation of IPv6 and IPvFuture addresses

...

Zyxel VMG8825-T50K 安全漏洞

The Zyxel VMG8825-T50K is an Internet access device from China Hopkins Zyxel. A security vulnerability exists in Zyxel VMG8825-T50K V5.50 ABOM.8.4 version C0 and prior versions. An attacker can exploit the vulnerability by sending a specially crafted HTTP POST request to cause the program to deny...

The vulnerability of the seg6_init() function in the implementation of the IPv6 protocol in Linux’s operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the seg6init function in the net/ipv6/seg6.c module of the Linux operating system’s IPv6 kernel implementation is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

UBUNTU-CVE-2024-53259

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IPPMTUDISCDO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceed...

CVE-2024-53728

Cross-Site Request Forgery CSRF vulnerability in Oliver Lindner Protect Your Content protect-your-content allows Stored XSS.This issue affects Protect Your Content: from n/a through = 1.0.2...

CVE-2024-53728

CVE-2024-53728 describes a CSRF to Stored XSS vulnerability in WordPress Protect Your Content (SEO-Küche Internet Marketing GmbH & Co. KG) affecting versions up to 1.0.2. Public sources (NVD/RH/CVE/CVE List) confirm the issue as CSRF leading to Stored XSS with a base CVSS v3.1 score of 7.1 (HIGH)...

CVE-2024-53728 WordPress Protect Your Content plugin <= 1.0.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Oliver Lindner Protect Your Content protect-your-content allows Stored XSS.This issue affects Protect Your Content: from n/a through = 1.0.2...

libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart

A NULL pointer dereference vulnerability was found in the Libreswan package. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the...

libreswan: Invalid IKEv2 REKEY proposal causes restart

An assertion failure flaw was found in the Libreswan package that occurs when processing IKEv2 REKEY requests. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notification INVALIDSPI is sent back. The notify payload's protocol ID is copied from...

The vulnerability of the IPSEC component of the Brocade Fabric OS allows attackers to enhance their privileges.

The vulnerability of the IPSEC component in the Brocade Fabric OS operating system is related to the lack of measures taken at the management level to clean data. Exploiting this vulnerability can allow attackers to enhance their privileges by executing a specially created portcfg command...

RHEL 9 : libreswan (RHSA-2024:10594)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:10594 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

Malicious code in calcnotepad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 84ad749380bb774a5cc7da818c03f863ee2838773e46e0a5c4cff469e1647962 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...