Security Bulletin: Apache Commons IO used by IBM InfoSphere Identity Insight has a potential vulnerability (CVE-2024-47554)

Summary The Apache Commons IO used by Identity Insight is vulnerable to a denial of service, caused by an uncontrolled resource consumption flaw in the org.apache.commons.io.input.XmlStreamReader class. By sending a specially crafted input, a remote attacker could exploit this vulnerability to...

CVE-2024-23953 Apache Hive: Timing Attack Against Signature in LLAP util

Use of Arrays.equals in LlapSignerImpl in Apache Hive to compare message signatures allows attacker to forge a valid signature for an arbitrary message byte by byte. The attacker should be an authorized user of the product to perform this attack. Users are recommended to upgrade to version 4.0.0,...

SUSE-SU-2025:0266-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005549 fixes several issues. The following security issues were fixed: - CVE-2024-41057: cachefiles: fix slab-use-after-free in cachefileswithdrawcookie bsc1229275. - CVE-2024-36971: Fixed dstnegativeadvice race bsc1226324. - CVE-2024-50264:...

CVE-2024-55931

The CVE-2024-55931 affects Xerox Workplace Suite. It discloses that tokens are stored in sessionStorage, which could be exposed if a user’s session is compromised. The vulnerability’s impact includes Confidentiality loss (per CVSS: High; I/N/A: none). Root cause is storage of tokens in session st...

CVE-2023-38714

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system...

CVE-2023-38714

CVE-2023-38714 affects IBM Cloud Pak System versions 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1, with the issue described as disclosing sensitive information about the system that could aid in further attacks. The IBM secur...

The anatomy of a Toxic Combination of Risk

How to uncover potential threats and eliminate critical risks in your cloud environment...

CVE-2024-52330

ECOVACS lawnmowers and vacuums are affected by CVE-2024-52330 due to improper TLS certificate validation. This allows an unauthenticated attacker to read or modify TLS traffic, potentially tampering with firmware updates. The vulnerability affects the product’s TLS handling in the affected device...

You are Not Alone, ChatGPT is Down

ChatGPT Outage: Service Down on Jan 23, 2025. Learn about the potential causes DDoS or technical glitch and…...

Security Bulletin: NVIDIA RAPIDS AI - January 2025

NVIDIA has released a software update for NVIDIA® RAPIDS AI cuDF and cuML to address the issues below. To protect your system, download and install this software update from the RAPIDS AI Machine Learning Library. Go to NVIDIA Product Security. Details This section provides a summary of potential...

CVE-2025-21556

Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain component: Agile Integration Services. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM...

CVE-2025-21529

CVE-2025-21529 affects Oracle MySQL Server, specifically the Information Schema, with vulnerable versions: 8.0.40 and prior, 8.4.3 and prior, and 9.1.0 and prior. The vulnerability can be exploited remotely over multiple protocols to cause the server to hang or crash (DoS). The connected sources ...

CVE-2025-21501

...

Wordfence Bug Bounty Researchers: Unlock More Earning Potential With New “Refer A Researcher” Program

Today, we at Wordfence are excited to announce a groundbreaking addition to our Wordfence Bug Bounty Program: the Refer-A-Researcher Program! Refer new researchers to our program and earn commissions when they submit valid vulnerabilities. This is a great opportunity to earn even more with the...

GHSA-J3G9-WG22-V955

creationtimestamp| type| source ---|---|--- 2025-01-20 22:59:41+00:00| seen| https://infosec.exchange/users/cve/statuses/113863162643434691 2025-01-20 23:00:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/2373...

LibreNMS Authenticated Remote Code Execution

An authenticated attacker can create dangerous directory names on the system and alter sensitive configuration parameters through the web portal. Those two defects combined then allows to inject arbitrary OS commands inside shellexec calls, thus achieving arbitrary code execution. This module...

Ubuntu: Security Advisory (USN-7214-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Bruno IDE Desktop Command Injection

A command injection vulnerability in the function shell.openExternal of Bruno IDE Desktop prior to version 1.29.0 allows attackers to execute arbitrary commands by supplying a crafted URL, leading to potential remote code execution. ===== Tempest Security Intelligence - ADV-10/2024...

SUSE SLES15 Security Update : kernel (Live Patch 45 for SLE 15 SP3) (SUSE-SU-2025:0131-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0131-1 advisory. This update for the Linux Kernel 5.3.18-15030059164 fixes several issues. The following security issues were fixed: - CVE-2024-50264:...

CVE-2024-12087

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...