go-toolset:rhel8 security update

An update is available for module.go-toolset, go-toolset, delve, golang, module.golang, module.delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset...

Mars: unauthorized access and add user and change personal information all users

The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of...

PT-2024-36: Calling arbitrary methods in Orchid Platform

The vulnerability was identified in Orchid Platform versions 8 - 14.42.x. Discovered vulnerability can be exploited by an attacker to call arbitrary methods in the Screen class, which could lead to the ability to brute force database tables and disclosure of the server's IP address. Vulnerability...

How Ransomware Is Delivered and How to Prevent Attacks

...

The vulnerability of the software platform for managing security in industrial networks, MXSecurity, arises from the use of dangerous methods or functions, allowing attackers to enhance their privileges.

The vulnerability of the MXSecurity software platform for managing security in industrial networks is related to the use of dangerous methods or functions. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2024-40897 · Unknown · Langchainjs

Name of the Vulnerable Software and Affected Versions: langchainjs version 0.2.5 Description: A path traversal issue exists, allowing attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. This is exploited through the setFileContent,...

ROS-20241028-02

The vulnerability of the net-netip component of Golang programming language is related to incorrect operation of Is methods IsPrivate, IsLoopback, etc. methods. Exploitation of the vulnerability can allow an intruder to bypass the existing access restriction policy...

This Week in Spring - October 22nd, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring. I write this to you in an Uber speeding down the autobahn near Frankfurt, Germany. What a time to be alive! At the rate this driver's going, I won't have much time to write this before we've arrived, so let's dive right into...

CVE-2024-40084

A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System = 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths...

SSRF via POST /v1/llm/add_llm and /v1/conversation/tts

This report is not public...

CVE-2024-40084

CVE-2024-40084 describes a remote, unauthenticated buffer overflow in the Boa webserver used by the Vilo 5 Mesh WiFi System (versions

CVE-2024-40084

A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System = 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths...

CVE-2024-40084

A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System = 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary code via exceptionally long HTTP methods or paths...

Malicious code in plugin-transform-private-methods (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9768 Malicious code in plugin-transform-private-methods (npm)

--- -= Per source details. Do not edit below this line.=-...

The vulnerability of the user console of the Avanpost IDM system, related to the use of dangerous methods or functions, allows a violator to execute arbitrary code.

The vulnerability of the user console of the Avanpost IDM system is related to the use of dangerous methods or functions. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the user console of the Avanpost IDM system, related to the use of dangerous methods or functions, allows a violator to execute arbitrary code.

The vulnerability of the user console of the Avanpost IDM system is related to the use of dangerous methods or functions. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2024-734)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-734 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

CVE-2024-47877 Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.

Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...