CVE-2024-6960

CVE-2024-6960 describes an unsafe deserialization flaw in H2O’s Iced framework: deserialized models can execute arbitrary code due to lack of a class whitelist. Public sources (including Red Hat RH/CVE and PT-Security) confirm this affects H2O, enabling potential code execution when importing cra...

CVE-2024-6960

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...

CVE-2024-6960: Deserialization of Untrusted Data

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class whitelist. An attacker can construct ...

H2O vulnerable to Deserialization of Untrusted Data

The H2O machine learning platform uses "Iced" classes as the primary means of moving Java Objects around the cluster. The Iced format supports inclusion of serialized Java objects. When a model is deserialized, any class is allowed to be deserialized no class allowlist. An attacker can construct ...

Oracle Database Server Java VM Unauthorized Access

The vulnerability of the Java VM component of the Oracle Database Server management system is related to the disclosure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Exploit for Code Injection in Vmware Cloud_Foundation

CVE-2024-22274 Exploit This repository contains an exploit fo...

MCSIO Unable to Move Page File to Write Cache Disk

When creating a machine catalog, MCSIO does not redirect the page file to the cache disk...

SolarWinds Serv-U Path Traversal Vulnerability

SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine...

OpenJDK: RangeCheckElimination array index overflow (8323231)

A vulnerability in Oracle Java SE and GraalVM Hotspot component affects multiple versions, allowing an unauthenticated attacker with network access to modify or access critical data. Exploitation is difficult but possible via APIs, such as web services supplying data. It also impacts Java...

OpenJDK: potential UTF8 size overflow (8314794)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

OpenJDK: Excessive symbol length can lead to infinite loop (8319859)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

CVE-2022-48785

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6getlladdr Some time ago 8965779d2c0e "ipv6,mcast: always hold idev-lock before mcalock" switched ipv6getlladdr to ipv6getlladdr, which is rcu-unsafe version. That was OK, because idev-lock...

Exploit for CVE-2024-33352

CVEID: CVE-2024-33352 Bluestacks Advisory ID: pending...

Delta Electronics CNCSoft-G2 Buffer Overflow Vulnerability (CNVD-2024-32986)

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. The Delta Electronics CNCSoft-G2 suffers from a buffer overflow vulnerability that can be exploited by an attacker to execute code in the context of the current process...

Delta Electronics CNCSoft-G2 Out-of-Bounds Write Vulnerability

Delta Electronics CNCSoft-G2 is a human-machine interface HMI software from Delta Electronics, China. Delta Electronics CNCSoft-G2 suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to execute code in the context of the current process...

XenServer and Citrix Hypervisor Security Update for CVE-2024-31143 and CVE-2024-31144

Description of Problem Two issues have been identified, the first of which affects both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR and the second of which affects Citrix Hypervisor 8.2 CU1 LTSR only. The first issue, which affects both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR, may allow...

1C-Bitrix: Virtual Machine Unrestricted File Execution

The vulnerability of the virtual server “1C-Bitrix: Virtual Machine” is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted PHP file...

Citrix Virtual Apps and Desktop - Machine Creation (MCS, PVS, App Layering)

Introduction This article is a summary of the top support articles related to Machine Creation including MCS, PVS and App Layering Top Support Knowledge Content Host Connections and Resource Errors CTX224551 - Delivery Controller cannot contact vCenter server after certificate update on vCenter...

Error: "HVM is Required for this Operation" when Trying to Start the VM in XenServer

Example 1 When trying to start the virtual machine VMthe following error is returned: “ There were no servers available to start VM ” The reason is displayed as “ HVM Hardware Virtual Machine is required for this operation ” Example 2 When trying to migrate a Windows VM from one host to another...

How to Configure a Promiscuous Virtual Machine in XenServer

This article describes how to configure a Virtual Machine VM running on XenServer to behave promiscuously on the network, that is, allow it to see all network traffic on the Physical Network Interface PIF. Certain applications, such as network diagnostic or performance monitoring tools, might...