The vulnerability of the Adobe PDFL Software Development Kit for creating, processing, and analyzing PDF documents lies in its ability to perform operations beyond the buffer boundaries in memory. This allows an attacker to execute arbitrary code.

The vulnerability of the Adobe PDFL Software Development Kit for creating, processing, and analyzing PDF documents lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2024-43594 Microsoft System Center Elevation of Privilege Vulnerability

...

CVE-2024-43594

CVE-2024-43594 is an elevation-of-privilege vulnerability in Microsoft System Center Operations Manager (SCOM). Public references describe it as a privilege-escalation issue with a CVSSv3.1 base score of 7.3 (HIGH): attack vector Local, attack complexity Low, privileges required Low, user interac...

CVE-2024-43594 Microsoft System Center Elevation of Privilege Vulnerability

...

Improper Input Validation

Synapse is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of invites received over federation, allowing a malicious server to send crafted invites that disrupt the affected user's ability to perform /sync operations...

Microsoft System Center Operations Manager 访问控制错误漏洞

Microsoft System Center Operations Manager is a large-scale monitoring and management software for corporate environments from Microsoft USA. The software, formerly known as MOM Microsoft Operations Manager, is primarily used to monitor IT systems and provide monitoring support for distributed...

Directus allows unauthenticated access to WebSocket events and operations

Summary When setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions with full admin privileges. Details Accountability for unauthenticated WebSocket requests is set to null, which used to be "publi...

GHSA-849R-QRWJ-8RV4 Directus allows unauthenticated access to WebSocket events and operations

Summary When setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions with full admin privileges. Details Accountability for unauthenticated WebSocket requests is set to null, which used to be "publi...

CVE-2024-54151: Exposure of Sensitive Information to an Unauthorized Actor

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...

CVE-2024-53143

CVE-2024-53143 affects the Linux kernel’s fsnotify path, fixing an ordering issue where iput() must complete before decrementing the watched_objects count. The patch ensures the superblock remains alive until iput() is done, preventing a potential use-after-free (UAF) of sb->s_fs_info in tmpfs...

VMware Aria Operations Multiple Vulnerabilities (VMSA-2024-0022)

The version of VMware Aria Operations running on the remote host is missing a vendor supplied patch. It is, therefore, affected by multiple vulnerabilities: - VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with local administrative privileges may trigger...

GHSA-4GRW-M28R-Q285 rPGP Potential Resource Exhaustion when handling Untrusted Messages

During a security audit, Radically Open Security discovered two vulnerabilities which allow attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys. Impact Affected rpgp versions do not...

Wiz Defend: Delivering the Promise of Cloud-Native Security Operations

A new approach to detect and respond to cloud-native threats...

Want to Grow Vulnerability Management into Exposure Management? Start Here!

Vulnerability Management VM has long been a cornerstone of organizational cybersecurity. Nearly as old as the discipline of cybersecurity itself, it aims to help organizations identify and address potential security issues before they become serious problems. Yet, in recent years, the limitations...

Hackers Target Uyghurs and Tibetans with MOONSHINE Exploit and DarkNimbus Backdoor

A previously undocumented threat activity cluster dubbed Earth Minotaur is leveraging the MOONSHINE exploit kit and an unreported Android-cum-Windows backdoor called DarkNimbus to facilitate long-term surveillance operations targeting Tibetans and Uyghurs. "Earth Minotaur uses MOONSHINE to delive...

The vulnerability of the proc/vmcore components of the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the proc/vmcore components in the Linux operating system’s kernel is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of component AsoC in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of component AsoC in the Linux operating system’s kernel is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the ABB VPNI function in the S+ Control API of the software for management and monitoring of ABB Symphony Plus S+ Operations, S+ Engineering, and S+ Analyst allows a perpetrator to trigger a service failure.

The vulnerability of the ABB VPNI function in the S+ Control API of the ABB Symphony Plus S+ Operations, S+ Engineering, and S+ Analyst software for management and monitoring systems is related to errors in processing relative paths. Exploiting this vulnerability can allow attackers to cause...

CVE-2024-36623

A flaw was found in Moby's streamformatter package. This vulnerability allows data corruption or application crashes via multiple concurrent write operations triggered by a race condition. Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

Command Execution Vulnerability in the Operation and Maintenance Management Audit System of Shanghai Shangxun Information Technology Co. Ltd (CNVD-C-2024-941497)

Founded in December 2010, Shanghai SinoCom-ArtM Information Technology Co., Ltd. is one of the leading domestic suppliers in the fields of data, intelligent security operation and maintenance, mobile security and security services. A command execution vulnerability exists in the Operations and...