SUSE-SU-2024:3976-1 Security update for pcp

This update for pcp fixes the following issues: pcp was updated from version 3.11.9 to version 6.2.0 jscPED-8192, jscPED-8389: - Security issues fixed: CVE-2024-45770: Fixed a symlink attack that allows escalating from the pcp to the root user bsc1230552 CVE-2024-45769: Fixed a heap corruption...

How to Choose the Best Analytics Tools for Mobile Apps

The app market is saturated with over 7 million apps across major stores. Analytics mobile apps have become…...

Protecting major events: An incident response blueprint

Ensuring the cybersecurity of major events -- whether it's sports, professional conferences, expos, inter-government meetings or other gatherings -- is a complex and time-intensive task. It requires a comprehensive approach and collaboration among various stakeholders, including vendors,...

Intel Broker Claims Cisco Breach, Selling Stolen Data from Major Firms

Intel Broker claims a major data breach at Cisco, allegedly stealing source codes, confidential documents, and credentials from…...

IT threat evolution Q2 2024

Targeted attacks XZ backdoor: a supply chain attack in the making On March 29, a message on the Openwall oss-security mailing list announced the discovery of a backdoor in XZ, a compression utility included in many popular Linux distributions. The backdoored library is used by the OpenSSH server...

Stadiums Are Embracing Face Recognition. Privacy Advocates Say They Should Stick to Sports

Protesters took to Citi Field Wednesday to raise awareness of the facial recognition systems that have become common at major league sporting venues...

The Noname Security 3.34 Update Includes Major Enhancements

...

CVE-2024-42233

In the Linux kernel, a vulnerability was fixed by replacing pteoffsetmap with pteoffsetmapnolock in the filemapfaultrecheckptenone function. The original use of pteoffsetmap relied on a potentially stale page table lock PTL, which could lead to a use-after-free UAF condition if the page table was...

CVE-2024-30170

PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,...

CVE-2024-6089 Rockwell Automation Major nonrecoverable fault in 5015 – AENFTXT

An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a manipulated PTP packet is sent, causing the secondary adapter to result in a major nonrecoverable fault. If exploited, a power cycle is required to recover the product...

CVE-2024-6089

The CVE-2024-6089 entry affects Rockwell Automation 5015 - AENFTXT (FLEXHA 5000 I/O). The issue is improper input validation triggered by manipulated PTP packets, which can cause the secondary adapter to suffer a major nonrecoverable fault, requiring a power cycle to recover. Affected version lis...

Busted for book club? Why cops want to see what you’re reading, with Sarah Lamdan (Lock and Code S05E14)

This week on the Lock and Code podcast… More than 20 years ago, a law that the United States would eventually use to justify the warrantless collection of Americans phone call records actually started out as a warning sign against an entirely different target: Libraries. Not two months after...

IntelBroker Hacker Claims Apple Breach, Steals Source Code for Internal Tools

Notorious hacker IntelBroker claims to have breached Apple, stealing source code for internal tools. Learn about the alleged breach and IntelBroker's history of targeting major companies and government entities...

CVE-2024-5659

Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable faultMNRF/Assert. This vulnerability could be exploited by sending abnormal packets to the mDNS port. If exploited, the availability of the device wou...

CVE-2024-5659 Rockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers

Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable faultMNRF/Assert. This vulnerability could be exploited by sending abnormal packets to the mDNS port. If exploited, the availability of the device wou...

CVE-2024-5659

CVE-2024-5659 affects Rockwell Automation controllers (ControlLogix 5580, GuardLogix 5580, 1756-EN4, CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480). The flaw is described as an Always-Incorrect Control Flow Implementation (MNRF/Assert) that can be triggered by abnormal packets sen...

CVE-2023-52748 f2fs: avoid format-overflow warning

In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid format-overflow warning With gcc and W=1 option, there's a warning like this: fs/f2fs/compress.c: In function ‘f2fsinitpagearraycache’: fs/f2fs/compress.c:1984:47: error: ‘%u’ directive writing between 1 and 7 bytes...

CVE-2024-4317

Missing authorization in PostgreSQL built-in views pgstatsext and pgstatsextexprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwi...

MajorDoMo 安全漏洞

MajorDoMo is an open source DIY smart home automation platform from the MajorDoMo community. A security vulnerability exists in versions prior to MajorDoMo v.0662e5e. An attacker exploited the vulnerability to escalate privileges via the thumb/thumb.php component...

FCC Fines Major U.S. Wireless Carriers for Selling Customer Location Data

The U.S. Federal Communications Commission FCC today levied fines totaling nearly $200 million against the four major carriers -- including AT&T, Sprint, T-Mobile and Verizon -- for illegally sharing access to customers location information without consent. The fines mark the culmination of a mor...