CVE-2023-49329

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlyi...

Anomali Match Security Vulnerability

Anomali Match is a big data security analytics engine from Anomali that automates threat detection, investigation and response. A security vulnerability exists in Anomali Match version 4.6.2 and prior versions, which stems from mishandling of untrusted input and could lead to an operating system...

CVE-2023-49329

Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This arises from improper handling of untrusted input, enabling an attacker to elevate privileges, execute system commands, and potentially compromise the underlyi...

PT-2024-13722 · Anomali · Anomali Match

Name of the Vulnerable Software and Affected Versions: Anomali Match versions prior to 4.6.2 Description: The issue arises from improper handling of untrusted input, enabling an attacker to inject and execute operating system commands. An authenticated admin user can elevate privileges, execute...

CVE-2024-0454

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than...

CVE-2024-0454 Security Vulnerability on Match-on-Chip FPR Architecture

ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor. This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity. Version which is lower than...

CVE-2024-0454

The CVE-2024-0454 issue affects Dell EMC ELAN Match-on-Chip FPR solutions, where a design fault can cause valid SID leakage and enumeration with a spoof sensor, enabling bypass of Windows Hello by cloning the SID to break account identity on the Dell Inspiron platform. Documented affected version...

PT-2024-15573 · Microsoft +1 · Windows Shell +1

Name of the Vulnerable Software and Affected Versions: ELAN Match-on-Chip FPR solution versions prior to 3.0.12011.08009 Legacy ELAN Match-on-Chip FPR solution versions prior to 3.3.12011.08103 ESS Description: The ELAN Match-on-Chip FPR solution has a design fault that poses a potential risk of...

Dell EMC ELAN Match-on-Chip FPR solution Security Vulnerability

The Dell EMC ELAN Match-on-Chip FPR solution is an on-chip match-on-chip FPR solution from Dell USA. A security vulnerability exists in previous versions of the Dell EMC ELAN Match-on-Chip FPR solution 3.0.12011.08009 Legacy/3.3.12011.08103 ESS, which stems from a SID leakage vulnerability that c...

Security Bulletin: IBM Match 360 is vulnerable to a denial of service of GraphQL Java within IBM WebSphere Application Server Liberty (CVE-2023-28867)

Summary IBM Match 360 is vulnerable to a denial of service of GraphQL Java within IBM WebSphere Application Server Liberty.GraphQL Java is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially crafted GraphQL query, a remote attacker could exploit this...

Security Bulletin: IBM Match 360 is vulnerable to a denial of service, caused by sending a specially-crafted request within IBM WebSphere Application Server Liberty (CVE-2023-38737)

Summary IBM Match 360 is vulnerable to a denial of service, caused by sending a specially-crafted request within IBM WebSphere Application Server Liberty. IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafte...

GHSA-GXHX-G4FQ-49HJ CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS

Impact CarrierWave::Uploader::ContentTypeAllowlist has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in allowlistedcontenttype? determines Content-Type permissions by performing a partial match. If the contenttype argument of allowlistedcontenttype? is...

CVE-2023-49090

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly leading to XSS. The validation in allowlistedcontenttype? determines Content-Type permissions by performing a partial match. If the...

New Flaws in Fingerprint Sensors Let Attackers Bypass Windows Hello Login

A new research has uncovered multiple vulnerabilities that could be exploited to bypass Windows Hello authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops. The flaws were discovered by researchers at hardware and software product security and offensive...

The vulnerability of the `simple_object_elf_match` function in the `libiberty/simple-object-elf.c` development toolset of the GNU Binutils allows a attacker to trigger a service failure.

The vulnerability of the simpleobjectelfmatch function in the libiberty/simple-object-elf.c development tool of the GNU Binutils library is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to cause service failures remotely...

rubygem-actionpack: Denial of Service in Action Dispatch

A flaw was found in the rubygem-actionpack. RubyGem's actionpack gem is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in Action Dispatch related to the If-None-Match header. By sending a specially-crafted HTTP If-None-Match header, a remote attacker...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

F5 Networks BIG-IP : glibc vulnerability (K54823184)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K54823184 advisory. - In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap- based buffer...

Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()

...

Moderate: Red Hat Security Advisory: curl security update

An update for curl is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...