Police investigate sexual assault on an avatar

British police are investigating a case involving a virtual sexual assault of a girls avatar. Even though there was no physical violence involved the incident will be investigated as it has caused psychological trauma. By definition, an avatar is a virtual representation of a user and is driven b...

PYSEC-2024-1 gratient 0.5 contains credential harvesting code

gratient is a user-facing library for generating color gradients of text. Version 0.5 contained obfuscated, malicious code targeting Windows platforms, harvesting information and credentials from the user's system and sending them to a remote server. Services may include Mullvad VPN and Telegram...

NewStart CGSL MAIN 6.02 : openssl Multiple Vulnerabilities (NS-SA-2023-0074)

The remote NewStart CGSL host, running version MAIN 6.02, has openssl packages installed that are affected by multiple vulnerabilities: - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell...

The vulnerability of the AVEVideoEncoder component in operating systems macOS, iOS, iPadOS, and tvOS allows a hacker to gain unauthorized access to protected information.

The vulnerability of the AVEVideoEncoder component in operating systems such as macOS, iOS, iPadOS, and tvOS is related to insufficient protection for sensitive data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

unsafe-libyaml unaligned write of u64 on 32-bit and 16-bit platforms

Affected versions allocate memory using the alignment of usize and write data to it of type u64, without using core::ptr::writeunaligned. In platforms with sub-64bit alignment for usize including wasm32 and x86 these writes are insufficiently aligned some of the time. If using an ordinary optimiz...

CVE-2023-32590

creationtimestamp| type| source ---|---|--- 2023-12-20 16:23:54+00:00| seen| https://t.me/ctinow/157118 2024-01-13 15:21:54+00:00| seen| https://t.me/ctinow/167852 2025-01-19 21:02:03+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lg4pubdvri2x 2025-02-24 15:46:41+00:00| seen...

Unaligned write of u64 on 32-bit and 16-bit platforms

Affected versions allocate memory using the alignment of usize and write data to it of type u64, without using core::ptr::writeunaligned. In platforms with sub-64bit alignment for usize including wasm32 and x86 these writes are insufficiently aligned some of the time. If using an ordinary optimiz...

CVE-2023-50784

A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server by sending an oversized packet if a websocket port is open. Remote code execution might be possible on some uncommon, older platforms...

SUSE CVE-2023-42883

The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. Processing an image may lead to a denial-of-service...

Code injection

PROBLEMTYPE in COMPONENT in VENDOR PRODUCT VERSION on PLATFORMS allows ATTACKER to IMPACT via VECTOR...

CVE-2023-49739

The PowerPack Pro for Elementor plugin for WordPress by IdeaBox Creations is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.9.23 . This flaw allows an unauthenticated attacker to execute malicious scripts. The issue is addressed in version 2.9...

Vulnerabilities fixed in Zoom

Zoom has fixed vulnerabilities in Zoom clients for Android, iOS, macOS, Linux and Windows. An authenticated malicious party can exploit the vulnerabilities to gain access to sensitive data, grant themselves elevated privileges or cause a denial-of-service attack. Zoom has released updates to fix...

The vulnerability of the `max_request_duration` component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to trigger a service failure.

The vulnerability of the maxrequestduration component in the HashiCorp Vault and Vault Enterprise platforms for archiving corporate information involves unlimited resource allocation during HTTP request processing. Exploiting this vulnerability could allow a malicious actor to cause service...

CVE-2023-42919

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3, iOS 16.7.3 and iPadOS 16.7.3, macOS Monterey 12.7.2. An app may be able to access sensitive user data...

CVE-2023-42914

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Monterey 12.7.2. An app may be able to break out of its sandbox...

CVE-2023-42898

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing an image may lead to arbitrary code execution...

Intel 2023.4 IPU Out-of-Band (OOB) Processor Security Update

Intel has informed HP of a potential security vulnerability in some Intel® Processors, which might allow escalation of privilege and/or information disclosure and/or denial of service via local access. Intel is releasing firmware updates to mitigate this potential vulnerability. Intel has release...

Intel 2023.4 IPU – BIOS November 2023 Security Update

Intel has informed HP of potential security vulnerabilities in the BIOS firmware for some Intel® Processors, which might allow escalation of privilege or denial of service. Intel is releasing BIOS updates to mitigate these potential vulnerabilities. Intel has released updates to mitigate the...

Design/Logic Flaw

An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...

CVE-2023-6507

An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...