Beware: New Vo1d Malware Infects 1.3 Million Android-based TV Boxes Worldwide

Nearly 1.3 million Android-based TV boxes running outdated versions of the operating system and belonging to users spanning 197 countries have been infected by a new malware dubbed Vo1d aka Void. "It is a backdoor that puts its components in the system storage area and, when commanded by attacker...

CVE-2024-45852

Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with...

PYSEC-2024-82

Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model to run arbitrary code on the server when interacted with...

PT-2024-31811 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.3.0 and newer Description: The issue is related to the deserialization of untrusted data in the MindsDB platform. This allows a maliciously uploaded 'inhouse' model to run arbitrary code on the server when a 'describe'...

MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in MindsDB version 23.10.2.0 and earlier, which stems from the presence of deserialization of untrusted data, allowing maliciously uploaded models to run arbitrary code on the server when...

PT-2024-31809 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.3.2.0 and newer Description: The issue concerns the deserialization of untrusted data in the MindsDB platform. This allows a maliciously uploaded model to run arbitrary code on the server when interacted with...

PT-2024-31812 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.2.0 and newer Description: The issue concerns the deserialization of untrusted data in the MindsDB platform. This allows a maliciously uploaded 'inhouse' model to run arbitrary code on the server when using 'finetune' o...

HPESBHF04702 rev.2 - Certain HPE ProLiant DL/ML/XL, Alletra, Synergy, and Edgeline Servers Using Certain Intel Processors, INTEL-SA-01103, 2024.3 IPU - Intel Processor RAPL Interface Advisory, Local Disclosure of Information Vulnerability

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL110 Gen10 Plus Telco server - Prior to v2.2008-07-2024 HPE ProLiant DL360 Gen10 Plus server - Prior to v2.2008-07-2024 HPE ProLiant DL380 Gen10 Plus server -...

The vulnerability of the microprogramming software of Mitel telephones of models 6800, 6900, 6970, and 6900w lies in the fact that it allows for the insertion or modification of arguments, enabling a perpetrator to execute arbitrary commands.

The vulnerability of the microprogramming software in SIP phones of the Mitel series 6800, 6900, 6970, and 6900w is related to the implementation or modification of arguments. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-Link多款产品 安全漏洞

D-Link DI-7003G and others are a wireless router from China-based AUO D-Link. A security vulnerability exists in various D-Link products. An attacker can exploit the vulnerability to achieve arbitrary command execution by sending a specially crafted string to the CGI function responsible for...

SAMSUNG Mobile Processor和SAMSUNG Wearable Processor 安全漏洞

SAMSUNG Mobile Processor and SAMSUNG Wearable Processor are both products of the South Korean company Samsung.SAMSUNG Mobile Processor is a series of mobile processors.SAMSUNG Wearable Processor is a series of wearable processors. SAMSUNG Mobile Processor is a series of mobile processors. A...

SAMSUNG Mobile Processor和SAMSUNG Wearable Processor 安全漏洞

SAMSUNG Mobile Processor and SAMSUNG Wearable Processor are both products of the South Korean company Samsung.SAMSUNG Mobile Processor is a series of mobile processors.SAMSUNG Wearable Processor is a series of wearable processors. SAMSUNG Mobile Processor is a series of mobile processors. A...

My Journey To CTO for Imperva App Sec

I’m delighted to be announcing that I’ve joined Imperva as the CTO for Application Security. Many of you readers know me as the Forrester analyst covering Zero Trust, SASE, and network security since before the pandemic. But what you might not have known is prior to that, I was in application...

Division By Zero Error

TensorFlow is vulnerable to a division by zero error. The vulnerability is due to insufficient handling of cases where the input's fourth dimension is zero in the DepthwiseConv TFLite operator, which can allows to execution issues or crashes in machine learning models...

CVE-2024-34577

Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser...

D-Link多款产品 命令注入漏洞

D-Link DNS-320 and others are products of China-based AUO D-Link.D-Link DNS-320 is a NAS Network Attached Storage device.D-Link DNS-120 is a Network Storage Adapter.D-Link DNS-315L is a Network Attached Storage.D-Link DNS-315L is a Network Attached Storage.D-Link DNS-320 is a Network Attached...

ELECOM多款产品 安全漏洞

ELECOM WRC-X3000GS2-W and others are products of ELECOM Corporation.ELECOM WRC-X3000GS2-W is a wireless router.ELECOM WRC-X3000GS2-B is a gigabit router.ELECOM WRC-X3000GS2A-B is a gigabit router. A security vulnerability exists in several ELECOM products, which originates from mishandling of inp...

Flowise 安全漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise version 1.8.2, which results in a denial of service due to improper handling of user-supplied input to the "/api/v1/get-upload-file" api endpoint...

Researchers Identify Over 20 Supply Chain Vulnerabilities in MLOps Platforms

Cybersecurity researchers are warning about the security risks in the machine learning ML software supply chain following the discovery of more than 20 vulnerabilities that could be exploited to target MLOps platforms. These vulnerabilities, which are described as inherent- and implementation-bas...

D-Link多款产品 命令注入漏洞

D-Link DNS-325 and others are a NAS Network Attached Storage device from China's D-Link Corporation. A command injection vulnerability exists in various D-Link products, which originates from a command injection flaw in the fpath parameter of the webdavmgr function in the /cgi-bin/webdavmgr.cgi...