CVE-2024-53202

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: Fix possible resource leak in fwlogfirmwareinfo The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with cryptofreeshash...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a resource leak in the firmwareloader module...

@volpe/astro-utils (>=0.0.1 <=0.0.20), astro-npm-loader (>=0.0.1 <=0.1.2) potentially affected by CVE-2024-56159 via astro (=5.0.0-beta.5)

astro NPM version =5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on astro and may be impacted: - @volpe/astro-utils =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-56159 Source advisory: OSV:GHSA-49W6-73CW-CHJR...

WordPress WP Nice Loader plugin <= 0.1.0.4 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin WP Nice Loader versions = 0.1.0.4...

Important: edk2

Issue Overview: A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. CVE-2021-28211 BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE. CVE-2021-28216 A BIOS bug in firmware for a particular PC model...

The vulnerability of the loader for AMD Platform Security Processor processors allows a hacker to execute arbitrary code.

The vulnerability of the loader for AMD Platform Security Processor processors involves incorrect checking of the range in the object header. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks

A new phishing campaign has been observed employing tax-themed lures to deliver a stealthy backdoor payload as part of attacks targeting Pakistan. Cybersecurity company Securonix, which is tracking the activity under the name FLUXCONSOLE , said it likely starts with a phishing email link or...

Dark web threats and dark market predictions for 2025

Review of last year's predictions The number of services providing AV evasion for malware cryptors will increase We continuously monitor underground markets for the emergence of new "cryptors," which are tools specifically designed to obfuscate the code within malware samples. The primary purpose...

OPENSUSE-SU-2024:14579-1 gdk-pixbuf-loader-libheif-1.19.5-2.1 on GA media

These are all security issues fixed in the gdk-pixbuf-loader-libheif-1.19.5-2.1 package on the GA media of openSUSE Tumbleweed...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11392 Hugging Face Transformers MobileViTV2 Des...

More_eggs MaaS Expands Operations with RevC2 Backdoor and Venom Loader

The threat actors behind the Moreeggs malware have been linked to two new malware families, indicating an expansion of its malware-as-a-service MaaS operation. This includes a novel information-stealing backdoor called RevC2 and a loader codenamed Venom Loader, both of which are deployed using...

The vulnerability of TP-Link Archer C7 Wi-Fi routers’ microprogramming software lies in the absence of authentication for a critical function, allowing attackers to gain unauthorized access to protected information.

The vulnerability of TP-Link Archer C7 Wi-Fi routers’ microprogramming software is related to the absence of authentication for a critical function during the loading of the l00.xml page. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to...

Malicious code in shopee-ui-automatic-import-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e30109d0ce569668c54f7d030ae4d33fd3858572a05996c3a53877d48629ef8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11094 Malicious code in shopee-ui-automatic-import-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e30109d0ce569668c54f7d030ae4d33fd3858572a05996c3a53877d48629ef8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

USN-7129-1: TinyGLTF vulnerability

It was discovered that TinyGLTF performed file path expansion in an insecure way on certain inputs. An attacker could possibly use this issue to cause a denial of service, or execute arbitrary code...

edk2: Integer overflows in PeCoffLoaderRelocateImage

A flaw was found in the EDK2 package. This flaw allows an attacker to cause memory corruption due to an overflow via an adjacent network. This issue may lead to loss of confidentiality, integrity, and availability...

The vulnerability of Grub2 operating system loaders, related to the incorrect use of standard permissions, allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of Grub2 operating system loaders is related to the incorrect use of standard permissions. Exploiting this vulnerability can allow attackers to circumvent security restrictions and gain unauthorized access to protected information...

WordPress CM Header & Footer Script Loader plugin <= 1.2.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin CM Header and Footer versions = 1.2.1...

WordPress CM Header & Footer Script Loader Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

Software CM Header & Footer Script Loader Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11202 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 36d111d1460e Credits...

Astra Linux – Vulnerability in Chromium

The use of “after free” in the Loader component in Google Chrome before version 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...