Malicious code in ssc-upload-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f805f8fdf8bbc931902fd9635ef6061d0bfc25743ba0a24a20ee876b6e2c8ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spex-dts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93132811b829ac6c32b8cf1e2c2c6bcaba42147399c45c495f0879e22871140f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Launches Windows Resiliency Initiative to Boost Security and System Integrity

Microsoft has announced a new Windows Resiliency Initiative as a way to improve security and reliability, as well as ensure that system integrity is not compromised. The idea, the tech giant said, is to avoid incidents like that of CrowdStrike's earlier this July, enable more apps and users to be...

CVE-2024-53071

CVE-2024-53071 affects the Linux kernel's drm/panthor driver. The panthor_device_mmap_io() path mishandles two IO-mapped regions: (1) it bails when VM_WRITE is set for DRM_PANTHOR_USER_FLUSH_ID_MMIO_OFFSET but does not clear VM_MAYWRITE, potentially allowing userspace to writable mappings later v...

CVE-2024-53071 drm/panthor: Be stricter about IO mapping flags

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Be stricter about IO mapping flags The current panthordevicemmapio implementation has two issues: 1. For mapping DRMPANTHORUSERFLUSHIDMMIOOFFSET, panthordevicemmapio bails if VMWRITE is set, but does not clear...

Malicious code in shopee-dashjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1566cc186f02b37e1800b37a0cda42b7e54616bfc7df46dc5fc7fd04b9bbd6db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rn-i18n-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec389a5953658ea1bda762a714a07855e1761843aef44b99159036fe37c81523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Researchers Warn of Privilege Escalation Risks in Google's Vertex AI ML Platform

Cybersecurity researchers have disclosed two security flaws in Google's Vertex machine learning ML platform that, if successfully exploited, could allow malicious actors to escalate privileges and exfiltrate models from the cloud. "By exploiting custom job permissions, we were able to escalate ou...

IBM Security ReaQta Cross-Site Scripting Vulnerability

ReaQta is an advanced endpoint security platform from IBM Security that utilizes artificial intelligence and machine learning technologies to identify, manage and automate responses to cybersecurity threats. A cross-site scripting vulnerability exists in Security ReaQta that stems from the...

UBUNTU-CVE-2024-3447

A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both s-datacount and the size of s-fifobuffer are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a...

kernel: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch The RFI and STF security mitigation options can flip the interruptexitnotreentrant static branch condition concurrently with the interrupt exit code...

kernel: x86/mce: Work around an erratum on fast string copy instructions

In the Linux kernel, the following vulnerability has been resolved: x86/mce: Work around an erratum on fast string copy instructions A rare kernel panic scenario can happen when the following conditions are met due to an erratum on fast string copy instructions: 1 An uncorrected error. 2 That err...

kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()

No description is available for this CVE...

kernel: vmci: prevent speculation leaks by sanitizing event in event_deliver()

A vulnerability was found in the eventdeliver function in the Linux kernel's VMCI component, where the issue involves a lack of sanitization for the eventdata.event index controlled by user-space, which could lead to speculative information leaks...

kernel: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups

In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to ASMEXTABLEUA for get,putuser fixups During memory error injection test on kernels = v6.4, the kernel panics like below. However, this issue couldn't be reproduced on kernels getusernocheck4+0x6/0x20 mce: Hardwa...

kernel: powerpc/64s: Fix unrecoverable MCE calling async handler from NMI

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unrecoverable MCE calling async handler from NMI The machine check handler is not considered NMI on 64s. The early handler is the true NMI handler, and then it schedules the machinecheckexception handler to run...

glib2: Signal subscription vulnerabilities

A flaw was found in GNOME GLib. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the...

Toward greater transparency: Publishing machine-readable CSAF files

Welcome to the third installment in our series on transparency at the Microsoft Security Response Center MSRC. In this ongoing discussion, we talk about our commitment to providing comprehensive vulnerability information to our customers. At MSRC, our mission is to protect our customers,...

November 12, 2024—KB5046612 (OS Build 14393.7515)

None None...

RHEL 9 : libvirt (RHSA-2024:9128)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9128 advisory. Kernel-based Virtual Machine KVM offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains...