CLSA-2024-1708029694 Update of nss

Update to CKBI 2.64 from NSS 3.95 - Removed: - Certificate "E-Tugra Certification Authority" - Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2" - Certificate "Hongkong Post Root CA 1" - Certificate "Symantec Class 1 Public Primary Certification Authority - G6" - Certificate "Symantec...

The vulnerability of the XWiki platform for creating collaborative web applications lies in its lack of access control mechanisms. This allows attackers to create new users.

The vulnerability of the XWiki Platform lies in its lack of access control mechanisms. Exploiting this vulnerability could allow a malicious actor to create a new user remotely...

new-ray.com Cross Site Scripting vulnerability OBB-3852101

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

newyorkhomehealthcare.com Cross Site Scripting vulnerability OBB-3851539

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Raspberry Robin Malware Upgrades with Discord Spread and New Exploits

The operators of Raspberry Robin are now using two new one-day exploits to achieve local privilege escalation, even as the malware continues to be refined and improved to make it stealthier than before. This means that "Raspberry Robin has access to an exploit seller or its authors develop the...

Epik, the Far Right's Favorite Web Host, Has a Shadowy New Owner

Known for doing business with far-right extremist websites, Epik has been acquired by a company that specializes in helping businesses keep their operations secret...

SUSE-SU-2024:0430-1 Security update for cosign

This update for cosign fixes the following issues: Updated to 2.2.3 jscSLE-23879: Bug Fixes: Fix race condition on verification with multiple signatures attached to image 3486 fixclean: Fix clean cmd for private registries 3446 Fixed BYO PKI verification 3427 Features: Allow for option in cosign...

CVE-2024-25558

The CVE-2024-25558 entry is associated with Google ChromeOS: the PowerVR GPU driver contains an integer overflow in DevmemIntChangeSparse() that enables controllable out-of-bounds writes. This could lead to memory corruption or elevation of privileges, as described in ChromeOS security notes tied...

Exploit for Forced Browsing in Fortra Goanywhere_Managed_File_Transfer

CVE-2024-0204: Authentication Bypass in GoAnywhere MFT Script...

CVE-2024-1192 South River WebDrive New Secure WebDAV denial of service

A vulnerability was found in South River WebDrive 18.00.5057. It has been declared as problematic. This vulnerability affects unknown code of the component New Secure WebDAV. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been...

CVE-2024-1192

The CVE-2024-1192 entry concerns South River WebDrive 18.00.5057. An issue in the New Secure WebDAV component can cause a denial of service, with the attack requiring local access. The vulnerability is linked to public exploit/disclosure, and multiple connected sources corroborate the affected pr...

CVE-2024-1192 South River WebDrive New Secure WebDAV denial of service

A vulnerability was found in South River WebDrive 18.00.5057. It has been declared as problematic. This vulnerability affects unknown code of the component New Secure WebDAV. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been...

CVE-2024-23831

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...

Rapid7 in Prague: Pete Rubio Shares Insights and Excitement for the New Office

As we continue to grow our customer base here at Rapid7, we’re growing our offices as well – this time with a new location in the Czech Republic. With a successful history of building innovation hubs from Boston to Belfast, our teams can’t wait to bring new talent from Prague into the business...

CVE-2024-23831

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...

CVE-2024-23831 Privilege escalation through CSRF attack on 'setup.pl'

LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in /setup.pl, an attacker can trick the admin into clicking on a link which automatically submits a request to setup.pl without the admin's consent. This request can be used...

Former CIA Engineer Sentenced to 40 Years for Leaking Classified Documents

A former software engineer with the U.S. Central Intelligence Agency CIA has been sentenced to 40 years in prison by the Southern District of New York SDNY for transmitting classified documents to WikiLeaks and for possessing child pornographic material. Joshua Adam Schulte, 35, was originally...

SUSE: Security Advisory (SUSE-SU-2024:0319-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-17346 · South River · South River Webdrive

Name of the Vulnerable Software and Affected Versions: South River WebDrive version 18.00.5057 Description: A vulnerability was found in the New Secure WebDAV component, which can lead to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the...

USN-6615-1: MySQL vulnerabilities

Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has been updated to 8.0.36 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. In addition to security fixes, the updated packages contain bug fixes, new features...