Kakao Piccoma Security Breach

Kakao Piccoma is a mobile application for reading manga by the Japanese company Kakao Piccoma. A security vulnerability exists in Kakao Piccoma versions prior to 6.20.0, which stems from the use of hard-coded API keys...

EulerOS 2.0 SP12 : shim (EulerOS-SA-2024-1876)

According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that...

USN-6854-1 openssl vulnerability

It was discovered that OpenSSL failed to choose an appropriately short private key size when computing shared-secrets in the Diffie-Hellman Key Agreement Protocol. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, resulting in a denial of service...

MAL-2024-1675 Malicious code in near-linkdrop-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ff40b77a91a8e45cd8e9541c0872d1e97a5e365768e2e6f34550d24f8c02fa0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1676 Malicious code in world-id-onchain-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23beae0d76f8d9d9ccbbe5079e8186b31119aa5d9ad66fe8fc49713db22dc4d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1672 Malicious code in colors-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3033329573120de896d630b7943ea5d68c1dd50a077ee370f8892df7d7460d47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-37354

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfssetitemkeysafe: BTRFS critical device vdb: slot 4 key 450 108 8192 new key 450 108 8192 ------------ cu...

XAES-256-GCM

About a year ago I wrote that “I want to use XAES-256-GCM/11, which has a number of nice properties and only the annoying defect of not existing.” Well, there is now an XAES-256-GCM specification. Had to give up on the /11 part, but that was just a performance optimization. XAES-256-GCM is an...

USN-6851-1 netplan.io vulnerabilities

Andreas Hasenack discovered that netplan incorrectly handled the permissions for netdev files containing wireguard configuration. An attacker could use this to obtain wireguard secret keys. It was discovered that netplan configuration could be manipulated into injecting arbitrary commands while...

MAL-2024-1669 Malicious code in elitebots-prevnames (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3421b5fe5476f1e1cae544e279bf1731be45c2e887956ef9dca25d2a96dfb9e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-6025 · Dell · Dell Client Platform Bios

Name of the Vulnerable Software and Affected Versions: Dell Client Platform BIOS affected versions not specified Description: The issue is related to the use of default cryptographic keys in the Dell BIOS, which could allow a high-privileged attacker with local access to bypass Secure Boot and...

Mageia: Security Advisory (MGASA-2024-0238)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2024-0238 Updated python-authlib packages fix security vulnerability

Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. This is similar to CVE-2022-29217 and CVE-2024-33663...

AZL-67446 CVE-2024-37354 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfssetitemkeysafe: BTRFS critical device vdb: slot 4 key 450 108 8192 new key 450 108 8192 ------------ cu...

UBUNTU-CVE-2024-37354

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfssetitemkeysafe: BTRFS critical device vdb: slot 4 key 450 108 8192 new key 450 108 8192 ------------ cu...

CVE-2024-37354 btrfs: fix crash on racing fsync and size-extending write into prealloc

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc We have been seeing crashes on duplicate keys in btrfssetitemkeysafe: BTRFS critical device vdb: slot 4 key 450 108 8192 new key 450 108 8192 ------------ cu...

Malicious code in asap-test-keys (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1775 Malicious code in asap-test-keys (npm)

--- -= Per source details. Do not edit below this line.=-...

Conduit Security Vulnerabilities

Conduit is a simple, fast and reliable chat server from the individual developer Timo Kösters. A security vulnerability exists in Conduit versions prior to v0.8.0, which stems from a key expiration that is not taken into account when verifying signatures, which could lead to an attacker using the...

PT-2024-9955 · Rockwell Automation · Rockwell Automation Factorytalk System Service

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk System Service affected versions not specified Description: The issue is related to the exposure of sensitive information due to the lack of explicit permissions set on the backup folder. A malicious user could...