ROS-20240826-07

A vulnerability in the SafeList.preserveRelativeLinks parameter of the Java library for analyzing, retrieving, and manipulating data in HTML jsoup documents is related to failure to take measures to protect the structure of a web page. Exploitation of the vulnerability could allow an attacker to...

Security Bulletin: Privilege escalation attack might affect IBM Storage Defender – Data Protect

Summary IBM Storage Defender – Data Protect is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilitiy has been addressed. CVE-2023-4623 Vulnerability Details CVEID:CVE-2023-4623 DESCRIPTION: Linux Kernel could allow a local authenticated attacker to...

CVE-2024-43849 soc: qcom: pdr: protect locator_addr with the main mutex

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: protect locatoraddr with the main mutex If the service locator server is restarted fast enough, the PDR can rewrite locatoraddr fields concurrently. Protect them by placing modification of those fields under the...

CVE-2024-42265

In the Linux kernel, the following vulnerability has been resolved: protect the fetch of -fdfd in dodup2 from mispredictions both callers have verified that fd is not greater than -maxfds; however, misprediction might end up with tofree = fdt-fdfd; being speculatively executed. That's wrong for t...

Understanding the New Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVE-2024-21302)

On August 7, 2024, Microsoft disclosed a significant security vulnerability affecting Windows-based systems, known as CVE-2024-21302. This zero-day vulnerability allows attackers with administrator privileges to elevate their access by replacing current versions of Windows system files with...

New Android Trojan "BlankBot" Targets Turkish Users' Financial Data

Cybersecurity researchers have discovered a new Android banking trojan called BlankBot targeting Turkish users with an aim to steal financial information. "BlankBot features a range of malicious capabilities, which include customer injections, keylogging, screen recording and it communicates with...

The vulnerability of Acronis Agent, a software protection tool from Acronis Cyber Protect 15, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Acronis Agent, a software solution for data protection, within Acronis Cyber Protect 15, is related to insufficient protection of operational data due to improper privilege assignment. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthoriz...

The vulnerability of the 1Panel Linux server control panel, related to the lack of security measures for SQL query structures, allows attackers to gain unauthorized access to protected information and execute arbitrary code.

The vulnerability of the 1Panel Linux server’s control panel is related to the lack of measures taken to protect the SQL query structure when processing the orderBy parameter. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information and execute arbitra...

Google Workspace Vulnerability Allowed Hackers to Access 3rd-Party Services

A Google Workspace vulnerability exposed thousands of accounts after hackers bypassed email verification. Learn how to protect your…...

CVE-2024-41056 firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Use strnlen on name fields in V1 wmfw files Use strnlen instead of strlen on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size...

Security Bulletin: Vulnerability in Linux kernel may affect IBM Spectrum Protect Plus

Summary IBM Spectrum Protect Plus can be affected by vulnerability in Linux Kernel. Vulnerability includes elevation of privileges, as described by the CVE in the "Vulnerability Details" section. Vulnerability Details CVEID:CVE-2023-51043 DESCRIPTION: Linux Kernel could allow a local authenticate...

It's best to just assume you’ve been involved in a data breach somehow

Between AT&T, all the follow-on activity from Snowflake, Microsoft Outlook, and more, its best to probably just assume at this point that your personal information has somehow been involved in a data breach. Were only halfway through 2024, and weve already seen some of the largest data breaches a...

CVE-2022-45449

Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 30984...

CVE-2022-45449

Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 30984...

CVE-2022-45449

CVE-2022-45449 affects Acronis Cyber Protect 15 prior to build 30984. The root cause is excessive privileges granted to the Acronis Agent, enabling potential exposure of sensitive information. Impact: confidential data disclosure; remote attacker could access protected data if privileges are abus...

CVE-2022-45449

Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 30984...

CVE-2022-45449

Sensitive information disclosure due to excessive privileges assigned to Acronis Agent. The following products are affected: Acronis Cyber Protect 15 Windows, Linux before build 30984...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Storage Protect Server and Operations Center

Summary Multiple vulnerabilities exist in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Storage Protect Server and IBM Storage Protect Operations Center. CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850...

Security Bulletin: There is a vulnerability in IBM® SDK, Java™ Technology Edition on z/OS used by IBM Storage Protect Server and Operations Center

Summary IBM Storage Protect Server and Operations Center are affected with vulnerabilities PSIRT-ADV0103951 under certain locales / codepages in IBM® SDK, Java™ Technology Edition on z/OS. Vulnerability Details IBM X-Force ID: PSIRT-ADV0103951 DESCRIPTION: Created from Advisory: ADV0103951 CVSS...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Storage Protect Server and Operations Center (CVE-2023-22081, CVE-2023-22067, CVE-2023-5676)

Summary Multiple vulnerabilities CVE-2023-22081, CVE-2023-22067, CVE-2023-5676 exist in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Storage Protect Server and IBM Storage Protect Operations Center. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified...