The vulnerability of the TrustZone subsystem’s networking (netdev) component in Qualcomm embedded operating systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the TrustZone subsystem for networking functions in Qualcomm embedded systems’ operating systems lies in the insufficient protection of sensitive data during the analysis of peripheral channels. Exploiting this vulnerability can allow attackers to gain unauthorized access to...

PT-2023-24879 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.3 through 15.11.9 GitLab CE/EE versions 16.0 through 16.0.5 GitLab CE/EE versions 16.1 through 16.1.0 Description: An issue has been discovered in GitLab CE/EE, which allows an attacker to merge arbitrary code into...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in Gitlab CE/EE that stems from allowing...

GitLab 注入漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 15.3 through 15.11.10,...

The vulnerability in the implementation of the Bluetooth Classic protocol, as specified in the Bluetooth Core Specification, allows a perpetrator to disclose protected information.

The vulnerability of the Bluetooth Classic protocol implementation, as described in the Bluetooth Core Specification, is related to insufficient protection of service data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

SUSE SLES15: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2023:2809-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2809-1 advisory. The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were...

Guidance on Microsoft Signed Drivers Being Used Maliciously

Executive Summary: Microsoft was recently informed that drivers certified by Microsoft’s Windows Hardware Developer Program MWHDP were being used maliciously in post-exploitation activity. In these attacks, the attacker gained administrative privileges on compromised systems before using the...

PT-2023-3827 · Microsoft · Windows Postscript Printer Driver +2

Name of the Vulnerable Software and Affected Versions: Windows PostScript Printer Driver Pscript and PCL6 Class Printer affected versions not specified Description: The issue is related to insufficient protection of system data in Windows operating systems, specifically affecting PostScript Print...

PT-2023-3865 · Microsoft · Windows Cdp User Components +1

Name of the Vulnerable Software and Affected Versions: Windows CDP User Components affected versions not specified Description: The issue is related to a lack of protection for service data in the Windows CDP component of the Windows operating system. This can allow an attacker to disclose...

PT-2023-3844 · Microsoft · Windows Failover Cluster +1

Name of the Vulnerable Software and Affected Versions: Windows Failover Cluster affected versions not specified Description: The issue is related to information disclosure in the Failover Cluster component of Windows operating systems. It allows a remote attacker to gain unauthorized access to...

CVE-2023-3219

The EventON WordPress plugin before 2.1.2 does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the...

CVE-2023-3219

The EventON WordPress plugin before 2.1.2 does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the...

Authorization

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventonicsdownload ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id...

CVE-2023-2796 EventON < 2.1.2 - Unauthenticated Event Access

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventonicsdownload ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id...

The vulnerability of the cURL command-line utility, related to uncontrolled resource consumption, allows a hacker to disclose protected information.

The vulnerability of the cURL command-line utility is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the system...

The vulnerability of Zoom video conferencing software, related to the disclosure of information in erroneous data fields, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of Zoom video conferencing software is related to the exposure of information in the erroneous data area. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

Technician Indicted for Hacking California Water Treatment Facility

By Deeba Ahmed The jury has charged Rambler Gallo with one count of transmitting a program, information, code, and command to cause damage to a protected computer. This is a post from HackRead.com Read the original post: Technician Indicted for Hacking California Water Treatment Facility...

The vulnerability of the command-line interface of the Aruba EdgeConnect Enterprise network management platform allows a attacker to disclose protected information.

The vulnerability of the command-line interface of the Aruba EdgeConnect Enterprise network management platform is related to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

MediaTek products缓冲区错误漏洞

MediaTek chips are a variety of chips from MediaTek, a Chinese company MediaTek. A security vulnerability exists in MediaTek, which originates from an out-of-bounds write in rpmb due to a logic error that may result in local privilege escalation. The following products are affected: MT6580, MT673...

The vulnerability of motion controllers and motion control systems like SIMOTION allows a intruder to disclose the protected information.

The vulnerability of SIMOTION motion controllers and motion control systems lies in the lack of protection for mission-critical data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...