CVE-2024-38098: Improper Link Resolution Before File Access

Azure Connected Machine Agent Elevation of Privilege Vulnerability...

CVE-2024-28986

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it...

KB5041773: Windows 10 Version 1607 / Windows Server 2016 Security Update (August 2024)

The remote Windows host is missing security update 5041773. It is, therefore, affected by multiple vulnerabilities - An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security VBS including a subset of Azure Virtual Machine SKUS. This can allo...

KB5041585: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (August 2024)

The remote Windows host is missing security update 5041585. It is, therefore, affected by multiple vulnerabilities - An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security VBS including a subset of Azure Virtual Machine SKUS. This can allo...

KB5041160: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (August 2024)

The remote Windows host is missing security update 5041160. It is, therefore, affected by multiple vulnerabilities - An elevation of privilege vulnerability exists in Windows based systems supporting Virtualization Based Security VBS including a subset of Azure Virtual Machine SKUS. This can allo...

Imperva Security Efficacy and Operational Efficiency Leads the Industry in SecureIQLab’s Cloud WAAP Comparative Report

In the 2024 Cloud Web Application and API Protection WAAP CyberRisk Comparative Validation Report from SecureIQLab, Imperva outperformed all other vendors in both security efficacy and operational efficiency. This comprehensive report, based on third-party testing, demonstrates Imperva's commitme...

PT-2024-31355

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description A NULL pointer dereference bug has been identified in the Linux kernel due to a data race. This issue occurs when the fscache cookie state machine function is slow and still running while anoth...

KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked

...

CWA-2024-004: Gas mispricing in cosmwasm-vm

Some Wasm operations take significantly more gas than our benchmarks indicated. This can lead to missing the gas target we defined by a factor of 10x. This means a malicious contract could take 10 times as much time to execute as expected, which can be used to temporarily DoS a chain. For more...

kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()

A flaw was found in the Linux kernel's x86 Machine Check Exception MCE subsystem. A local user with administrative privileges could trigger a race condition by concurrently modifying Machine Check Architecture MCA bank configuration attributes through the sysfs interface. This issue occurs becaus...

kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank()

A flaw was found in the Linux kernel's x86 Machine Check Exception MCE subsystem. A local user with administrative privileges could trigger a race condition by concurrently modifying Machine Check Architecture MCA bank configuration attributes through the sysfs interface. This issue occurs becaus...

CVE-2024-21302

Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this...

CVE-2024-21302: Improper Access Control

Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this...

Malicious code in new-relic-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b484734422b24dacf15c15aabdc6a98a5b34da6281c42feab2eea60be6bd36f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in waffles-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ad7999ec655f7d6bcdf01058afe01c8048b5f27374304462cac174b0d1e0ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Insecure Deserialization

com.xuxueli, xxl-rpc-core is vulnerable to Insecure Deserialization. The vulnerability is caused due to a missing validation while deserializing the user supplied data when a TCP server is set up using the Netty framework and the Hessian serialization mechanism. Attackers can abuse this to take...

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Summary: As of July 10, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to protect your systems from this...

Kibana ML Connector Code Execution

The vulnerability of the ML connector functions and the Alerting service of the Kibana data visualization service is related to uncontrolled changes in object prototype attributes. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

PT-2024-5372 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 8.14.2 Kibana versions prior to 7.17.23 Description: A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to interna...

Kibana 8.14.2 / 7.17.23 Security Update (ESA-2024-22)

Kibana arbitrary code execution via prototype pollution ESA-2024-22 A flaw allowing arbitrary code execution was discovered in Kibana. An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability,...