Remote Code Execution (RCE)

torch is vulnerable to Remote Code Execution RCE. The vulnerability is caused by a lack of restriction on function calls when a worker node sends a PythonUDF to the master node, which then executes the function without proper validation within the torch.distributed.rpc framework. This allows...

Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer

We analyze the multi-stage loading technique used by Water Sigbin to deliver the PureCrypter loader and XMRIG crypto miner...

TP-LINK ER7206 Command Execution Vulnerability

The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. A command execution vulnerability exists in the TP-Link ER7206 Omada Gigabit VPN Router version 1.4.1 Build 20240117, which stems from the presence of residual debugging code that can be exploited by an attacker to caus...

CVE-2024-3017

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

CVE-2024-3017

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

CVE-2024-3017 Denial of service in multi-protocol gateway - Zigbee + Thread

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

CVE-2024-3017

The CVE-2024-3017 entry describes a vulnerability in Silicon Labs multi-protocol gateway where a corrupt pointer to buffered data on the multi-protocol radio co-processor (RCP) can cause the OpenThread Border Router (OTBR) application task on the host to crash, enabling a temporary denial-of-serv...

Snowflake isn’t an outlier, it’s the canary in the coal mine

By Nick Biasini with contributions from Kendall McKay and Guilherme Venere Headlines continue to roll in about the many implications and follow-on attacks originating from leaked and/or stolen credentials for the Snowflake cloud data platform. Adversaries obtained stolen login credentials for...

CVE-2024-0949

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68...

CVE-2024-0949 Improper Access Control in Talya Informatics' Elektraweb

Missing Authentication, Files or Directories Accessible to External Parties, Use of Hard-coded Credentials vulnerability in Talya Informatics Elektraweb allows Authentication Bypass. This issue affects Elektraweb: before v17.0.68...

CVE-2024-0949

CVE-2024-0949 affects Talya Informatics’ Elektraweb prior to 17.0.68. The issue is described as Missing Authentication and Use of Hard-coded Credentials that enables Authentication Bypass due to improper access control, potentially exposing files/directories externally and impacting confidentiali...

CVE-2024-3017: Out-of-bounds Read

In a Silicon Labs multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP causes the OpenThread Border RouterOTBR application task running on the host platform to crash, allowing an attacker to cause a temporary denial-of-service...

PT-2024-23221

Name of the Vulnerable Software and Affected Versions Silicon Labs multi-protocol gateway affected versions not specified Description The issue is caused by a corrupt pointer to buffered data on a multi-protocol radio co-processor RCP in a Silicon Labs multi-protocol gateway. This corruption caus...

PT-2024-15930

Name of the Vulnerable Software and Affected Versions Elektraweb versions prior to 17.0.68 Description The issue is related to improper access control, missing authorization, and incorrect permission assignment for critical resources. It allows for exploiting incorrectly configured access control...

com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin (>=0.6, <=0.7), com.groupon.jenkins-ci.plugins:dotci (>=2.37.0, <=2.40.00) +18 more potentially affected by CVE-2024-39458 via org.jenkins-ci.plugins:structs (1.4)

org.jenkins-ci.plugins:structs MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:structs and may be impacted: - com.github.mjdetullio.jenkins.plugins:multi-branch-project-plugin =0.6, =2.37.0, =1.0.0-b02,...

Aimeos HTML client may potentially reveal sensitive information in error log

Impact Debug information can reveal sensitive information from environment variables in error log Affected platform Laravel environments with multi-vendor setups and admin access for the vendors...

GHSA-PPM5-JV84-2XG2 Aimeos HTML client may potentially reveal sensitive information in error log

Impact Debug information can reveal sensitive information from environment variables in error log Affected platform Laravel environments with multi-vendor setups and admin access for the vendors...

Stolen Singaporean Identities Sold on Dark Web Starting at $8

Singapore citizens, beware! Cybercriminals are targeting your digital identities and KYC data, starting at just $8, putting users at risk of exploitation. Learn how to protect your data, finances, and reputation with strong passwords, multi-factor authentication, and smart online habits...

MAL-2024-6994 Malicious code in multi-movingsign (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

From Top Dogs to Unified Pack

Embracing a consolidated security ecosystem Authored by Ralph Wascow Cybersecurity is as unpredictable as it is rewarding. Each day often presents a new set of challenges and responsibilities, particularly as organizations accelerate digital transformation efforts. This means you and your cyber...