CVE-2024-7401

CVE-2024-7401 affects Netskope Client enrollment: NSClient uses a static OrgKey token as authentication parameter, which cannot be rotated if leaked. Root cause is the static token in the enrollment flow; impact is impersonation by enrolling NSClient from a customer tenant. Public fix details are...

CVE-2024-42370

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions 2.10.0 and prior, Litestar's docs-preview.yml workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the...

CVE-2024-42370 Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions 2.10.0 and prior, Litestar's docs-preview.yml workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the...

CVE-2024-42370

Litestar (versions 2.10.0 and earlier) is affected by an environment variable injection flaw in the docs-preview.yml workflow. A crafted artifact can be introduced via the workflow’s artifact handling, potentially exposing DOCS_PREVIEW_DEPLOY_TOKEN and granting the attacker permissions to write i...

CVE-2024-42370 Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions 2.10.0 and prior, Litestar's docs-preview.yml workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the...

CVE-2024-42370 Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions 2.10.0 and prior, Litestar's docs-preview.yml workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the...

There is no real fix to the security issues recently found in GitHub and other similar software

A recently discovered security issue in GitHub and other, similar, control system products seem to fit into the classic "its a feature, not a bug" category. Security researchers last week published their findings into some research of how deleted forks in GitHub work, potentially leaving the door...

VMware ESXi Authentication Bypass Vulnerability

VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host that was previously configured to use AD for user management by re-creating the configured AD group 'ESXi Admins' by default after it...

The vulnerability of the RubyGems.org repository, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the RubyGems.org repository for programming languages involves an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the Layer-2 Bridge network driver for Windows operating systems allows a hacker to cause a service failure.

The vulnerability of the Layer-2 Bridge network driver for Windows operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the WebSocket protocol in the Apache HTTP Server web server allows a attacker to induce a service failure.

The vulnerability of the WebSocket protocol in the Apache HTTP Server is related to the assignment of a null pointer. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

CVE-2024-2602

CVE-2024-2602 maps to Schneider Electric EcoStruxure Foxboro SCADA FoxRTU Station, where a Path Traversal flaw in the saved project file handling can enable remote code execution for an authenticated user if the project file has been tampered. Connected sources indicate this affects FoxRTU Statio...

CVE-2024-2602

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could result in remote code execution when an authenticated user executes a saved project file that has been tampered by a malicious actor...

CVE-2024-5680

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

CVE-2024-38330 IBM i privilege escalation

IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 295227...

CVE-2024-37005

A maliciously crafted XB file, when parsed in pskernel.DLL through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash,read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2024-23158

A maliciously crafted IGES file, when parsed in ASMImport229A.dll through Autodesk applications, can be used to cause a use-after-free vulnerability. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process...

CVE-2024-36999

CVE-2024-36999 affects Autodesk AutoCAD and related products that parse 3DM files via opennurbs.dll. The vulnerability arises from an out-of-bounds write when handling malicious 3DM data, potentially crashing the application, exposing data, or permitting arbitrary code execution in the process co...

CVE-2024-23158 Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products

A maliciously crafted IGES file, when parsed in ASMImport229A.dll through Autodesk applications, can be used to cause a use-after-free vulnerability. A malicious actor can leverage this vulnerability to cause a crash or execute arbitrary code in the context of the current process...

CVE-2024-23151 Multiple ZDI Vulnerabilities in Autodesk AutoCAD and certain AutoCAD-based products

A maliciously crafted 3DM file, when parsed in ASMkern229A.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...