8319 matches found
PT-2024-37987 · Gargaj · Gargaj
Name of the Vulnerable Software and Affected Versions: Gargaj wuhu up to 3faad49bfcc3895e9ff76a591d05c8941273d120 Description: A critical vulnerability has been found in the Slide Editor component of the affected software, specifically in the /slideeditor.php file. The issue arises from the...
Fedora 39 : tcpreplay (2024-740d26aaf7)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-740d26aaf7 advisory. Announcing v4.5.1 This release contains contributions from a record number of new contributors. This is greatly appreciated since I am a team of one, and do...
Important: composer
Issue Overview: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches fo...
Important: composer
Issue Overview: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the status, reinstall and remove commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches fo...
CLSA-2024-1721204990 Update of kernel
Add dependency for updated shim and grub2 with new signing key...
SUSE-SU-2024:2543-1 Security update for nodejs20
This update for nodejs20 fixes the following issues: Update to 20.15.1: - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass bsc1227560 - CVE-2024-22020: Fixed a bypass of network import restriction via data URL bsc1227554 - CVE-2024-22018: Fixed fs.lstat bypasses permission model bsc1227562 -...
SUSE CVE-2024-40966
In the Linux kernel, the following vulnerability has been resolved: tty: add the option to have a tty reject a new ldisc ... and use it to limit the virtual terminals to just NTTY. They are kind of special, and in particular, the "conwrite" routine violates the "writes cannot sleep" rule that som...
CVE-2024-6328
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebasesmslogin' and 'firebasesmsloginv2' functions...
Linux kernel security vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an issue with the ionic component using a released network interface card when handling the NAPI New API for...
Inside the ransomware playbook: Analyzing attack chains and mapping common TTPs
Given the recent slate of massive ransomware attacks that have disrupted everything from hospitals to car dealerships, Cisco Talos wanted to take a renewed look at the top ransomware players to see where the current landscape stands. Based on a comprehensive review of more than a dozen prominent...
CVE-2024-31318
CVE-2024-31318 affects Android’s CompanionDeviceManagerService.java. The flaw is a missing permission check that could allow pairing a companion device without user acceptance, enabling local elevation of privilege with no extra execution privileges required. User interaction is not needed for ex...
CVE-2024-31317
CVE-2024-31317 is a Zygote command-injection vulnerability affecting Android 9–13, enabling a non-privileged app with WRITE_SECURE_SETTINGS to trigger code execution in the Zygote process via unsafe deserialization and manipulated Zygote arguments (e.g., runtime-flags, hidden_api_blacklist_exempt...
CVE-2024-23696
The CVE-2024-23696 issue is tied to the RGXCreateZSBufferKM function in rgxta3d.c, where a use-after-free leads to possible arbitrary code execution and local elevation of privilege in the kernel. Exploitation reportedly requires local access with no extra privileges and no user interaction. Conn...
Eldorado Ransomware Targeting Windows and Linux with New Malware
Another day, another threat against Windows and Linux systems!...
CVE-2023-50807
CVE-2023-50807 concerns Samsung Wearable Processor and Modems (Exynos 9110; Exynos Modem 5123; Exynos Modem 5300). The issue is an out-of-bounds write on the heap in 2G, exploitable with no authentication. Multiple connected sources (NVD, Red Hat, CVE list, CNNVD, OSV) corroborate the same descri...
PT-2024-23958 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions affected versions not specified Description: The issue is related to improper input validation in the AutofillManagerServiceImpl.java, specifically in the newServiceInfoLocked method. This could allow an enabled Autofill...
Ticketmaster hackers release stolen ticket barcodes for Taylor Swift Eras Tour [updated]
The cybercriminals who claimed responsibility for the Ticketmaster data breach say theyve stolen 440,000 tickets for Taylor Swift’s Eras Tour. As proof, an entity using the handle Sp1d3rHunters, a merger of Sp1d3r and ShinyHunters who are both aliases associated with the breach, leaked 170k...
CLSA-2024-1720178308 Update of alt-php
SECURITY UPDATE: New microcode data file 2024-05-14 - New microcodes: sig 0x000a06a4, pfmask 0xe6, 2024-01-03, rev 0x001c, size 136192 sig 0x000b06a8, pfmask 0xe0, 2023-12-07, rev 0x4121, size 220160 sig 0x000c06f1, pfmask 0x87, 2024-02-05, rev 0x21000230, size 552960 sig 0x000c06f2, pfmask 0x87,...
Duplicate Advisory: Gogs allows argument injection during the tagging of a new release
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references. Original Description Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixe...
