Security Bulletin: IBM Edge Application Manager 4.5.4 addresses the security vulnerabilities listed in the CVEs below.

Summary IBM Edge Application Manager 4.5.4 addresses the security vulnerabilities listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-48795 DESCRIPTION: OpenSSH is vulnerable to a machine-in-the-middle attack, caused by a flaw in the extension negotiation process in the SSH transport...

The vulnerability of the Delta Industrial Automation DOPSoft software for designing human-machine interfaces lies in the copying of buffers without checking the size of the input data. This allows a malicious actor to execute arbitrary code.

The vulnerability of the Delta Industrial Automation DOPSoft software for designing human-machine interfaces lies in the copying of buffers without checking the size of input data during syntax analysis of the wKPFStringLen field. Exploiting this vulnerability allows a malicious actor to execute...

PYSEC-2024-151

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics o...

CVE-2024-24567 raw_call `value=` kwargs not disabled for static and delegate calls

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics o...

CVE-2024-24567

The CVE-2024-24567 issue concerns Vyper, a Pythonic language for the Ethereum VM. The vulnerability is in the Vyper compiler’s raw_call builtin, where a value argument can be passed even when the call is delegatecall or staticcall. However, due to the semantics of delegatecall/staticcall opcodes,...

CVE-2024-24567 raw_call `value=` kwargs not disabled for static and delegate calls

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin rawcall even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics o...

PT-2024-21468

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a circular locking dependency in the KVM Kernel-based Virtual Machine component of the Linux kernel, specifically on arm64 architectures. The problem arises becau...

PT-2024-15739 · Lamassu · Lamassu Bitcoin Atm Douro

Name of the Vulnerable Software and Affected Versions: Lamassu Bitcoin ATM Douro version 7.1 Description: The issue is related to improper checking for unusual or exceptional conditions in the Lamassu Bitcoin ATM Douro machines. This could allow an attacker with physical access to the ATM to esca...

Lamassu Bitcoin ATM Douro Security Breach

Lamassu Bitcoin ATM Douro is a Bitcoin ATM from Lamassu. A security vulnerability exists in the Lamassu Bitcoin ATM Douro version 7.1 that stems from allowing the use of weak passwords. An attacker could exploit the vulnerability to retrieve stored hashes from the machine and crack passwords up t...

MachineSense FeverWarn Access Control Error Vulnerability

MachineSense FeverWarn is a temperature detection device from MachineSense. MachineSense FeverWarn suffers from an access control error vulnerability. An attacker could exploit the vulnerability to view source code, secret credentials, and more...

TemporAI Code Issue Vulnerability

TemporAI is a machine learning-centered medical time series library open-sourced by vanderSchaar LAB. A code issue vulnerability exists in vanderSchaar LAB TemporAI version 0.0.3, which stems from an incorrect operation that can lead to deserialization...

kernel: SEV-ES local priv escalation

A buffer overflow and null pointer dereference flaw was found in the Linux kernel's Secure Encrypted Virtualization SEV implementation for AMD functionality. This issue occurs when a user in SEV guest VM accesses MMIO registers, which could allow a local user to crash the system or escalate their...

kernel: SEV-ES local priv escalation

A buffer overflow and null pointer dereference flaw was found in the Linux kernel's Secure Encrypted Virtualization SEV implementation for AMD functionality. This issue occurs when a user in SEV guest VM accesses MMIO registers, which could allow a local user to crash the system or escalate their...

Virtuozzo Hybrid Infrastructure 5.4 Update 4 Hotfix 6 (5.4.4-150)

This update provides stability and performance improvements. Vulnerability id: VSTOR-79658, VSTOR-80254 Reworked eligibility checks for third-party packages. Vulnerability id: VSTOR-79881 For S3 objects uploaded by using multipart upload, replacing one object with another with the same name may...

Malicious code in wlwz-2312-6901 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b93c4ad44423942b435de63caf1ec77479ccf4e253b0942a59f0c6fcca3d8a5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-5503 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25f541391fe869491840ea7b1859e1bf016380f26a7d586b45c96f5bbabcba79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-2906 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e46092997b47ebc6f98019c4cef41b36cf29e0fcaaf45958cbfe97fb0042204 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1702 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 921c48bc0256d191ef596f8241ffc86ec9742b3fd78ac197f08a6d7d12cf4a4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1507 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e59358cb28ffae294a0c12bc19cba69d1e1d3d6b926f0f3c415371efd4724b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-0907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad3aeb031e9e9d9f91f64a1eb64be2c4a49362f64eff9307718007e80e129b0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...