Command injection

An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments...

Assumptions are currently made that prices would forever be positive

Lines of code Vulnerability details Impact Neglecting the potential for negative asset prices can lead to inaccurate value representation in the Liquidity Pool, possibly affecting calculations related to assets and tokens. It's crucial to note that the value of an asset, even if negative in the...

The vulnerability of the PAMcheckPasswd() function, a utility for managing and monitoring processes, programs, files, and Monit directories, allows a perpetrator to increase their privileges.

The vulnerability of the PAMcheckPasswd function, a utility for managing and monitoring processes, programs, files, and Monit directories, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

Sql injection

ARDEREG ?Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, th...

The utilization of strict equality within the subtractLoss function is susceptible to straightforward manipulation by a potential attacker.

Lines of code Vulnerability details Impact If this equality condition is intentionally disrupted, it will result in the failure of all settlement processes carried out using the settle function. Proof of Concept Tools Used Manual review Recommended Mitigation Steps - collateral.balanceOfaddressth...

CVE-2023-4485 ARDEREG Sistemas SCADA SQL Injection

ARDEREG ​Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, th...

selinux-policy bug fix update

An update is available for selinux-policy. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The selinux-policy packages contain the rules that govern how confined...

Survey Provides Takeaways for Security Pros to Operationalize their Remediation Life Cycle

Ask any security professional and they'll tell you that remediating risks from various siloed security scanning tools requires a tedious and labor-intensive series of steps focused on deduplication, prioritization, and routing of issues to an appropriate "fixer" somewhere in the organization. Thi...

CVE-2023-41121

Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations...

CVE-2023-41121

Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP operations...

Linux kernel memory misreference vulnerability (CNVD-2023-64508)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A memory misreference vulnerability exists in versions of Linux kernel prior to 6.4.10, which stems from the mishandling of sub-processes of sk, and can be exploited by an...

The vulnerability of AMD’s microprogramming software lies in the lack of protection for service data, which allows attackers to access the memory contents of other users’ processes.

The vulnerability of AMD’s microprogrammed software lies in the lack of protection for system data. Exploiting this vulnerability can allow attackers to access the memory contents of other users’ processes...

Siemens Solid Edge Out-of-Bounds Read Vulnerability (CNVD-2023-62033)

Solid Edge is a portfolio of software tools that address a variety of product development processes: 3D design, simulation, manufacturing and design management. Siemens Solid Edge suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute code in the context ...

How to Leverage the AWS Cost Optimization Pillar

Explore the Cost Optimization pillar of the AWS Well-Architected Framework and gain best practices for designing processes that make it possible to go to market and optimize costs early on...

CVE-2023-32364

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Ventura 13.5. A sandboxed process may be able to circumvent sandbox restrictions...

PT-2023-24727 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.4.0 through 1.7.0 Description: The issue allows an attacker to use general users to delete and update processes that should only be operable by admins. Recommendations: For versions 1.4.0 through 1.7.0, upgrade to...

The vulnerability of AMD’s microprogramming software for CPUs based on the Zen2 microarchitecture allows a hacker to access the contents of registers during other processes executed on the same CPU core.

The vulnerability of AMD’s microprogrammed software for CPUs based on the Zen2 microarchitecture is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to monitor the contents of registers during other processes executed by the same CPU core...

Apache InLong 安全漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. It provides automated, secure, and reliable data transfer capabilities. Apache Software Foundation A security vulnerability exists in Apache InLong versions 1.4.0 through 1.7.0, which stems from a...

GHSA-5652-92R9-3FX9 Decidim Cross-site Scripting vulnerability in the processes filter

Impact The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of...

CVE-2023-34089 Decidim Cross-site Scripting vulnerability in the processes filter

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code ...