User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation due to insufficient validation in the MsgCommitPubRandList handler, combined with a lack of domain separation in signed messages. An attacker can store an invalid PubRand commitment by crafting the message parameters ...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation due to insufficient validation in the MsgCommitPubRandList handler, combined with a lack of domain separation in signed messages. An attacker can store an invalid PubRand commitment by crafting the message parameters ...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a failure to properly handle device separation in spi: fsl-qspi could cause the kernel to crash...

The vulnerability of the getty component of the finite initialization system allows a intruder to gain unauthorized access to the system.

The vulnerability of the getty component of the FINIT initialization routine is related to the lack of argument separation when accessing the /bin/login process via the command line. Exploiting this vulnerability can allow an attacker to gain unauthorized access to the system...

UBUNTU-CVE-2022-49765

In the Linux kernel, the following vulnerability has been resolved: net/9p: use a dedicated spinlock for transfd Shamelessly copying the explanation from Tetsuo Handa's suggested patch1 slightly reworded: syzbot is reporting inconsistent lock state in p9reqput2, for p9tagremove from p9reqput from...

Preserving Privacy and Utility in LLM-Based Product Recommendations

Large Language Model LLM-based recommendation systems leverage powerful language models to generate personalized suggestions by processing user interactions and preferences. Unlike traditional recommendation systems that rely on structured data and collaborative filtering, LLM-based models proces...

Decoupling Identity from Access: Credential Broker Patterns for Secure CI/CD

Credential brokers offer a way to separate identity from access in CI/CD systems. This paper shows how verifiable identities issued at runtime, such as those from SPIFFE, can be used with brokers to enable short-lived, policy-driven credentials for pipelines and workloads. We walk through practic...

Echo 安全漏洞

Echo is an open source community system with no separation of front and back end for Veal98 individual developers. A security vulnerability exists in Echo version 4.2, which stems from an improper authorization issue in the documentation...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the presence of a UAF in hid-steam when separating devices...

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx, related to insufficient spatial partitioning, allows a hacker to execute arbitrary code.

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to insufficient spatial separation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the controller’s context, from a remote location...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a concurrent post-release reuse issue during NCI device separation...

CVE-2024-20311

A vulnerability in the Locator ID Separation Protocol LISP feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to the incorrect handling of LISP packets. An attacker could exploit...

DEBIAN-CVE-2024-57804

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and...

UBUNTU-CVE-2024-57804

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and...

CVE-2024-57804 scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and...

SUSE CVE-2024-56745

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix resetmethodstore memory leak In resetmethodstore, a string is allocated via kstrndup and assigned to the local "options". options is then used in with strsep to find spaces: while name = strsep&options, " " != NULL If...

The vulnerability of the network management system for monitoring industrial networks in Siemens SINEC NMS, related to insufficient privilege separation, allows a intruder to execute arbitrary commands.

The vulnerability of the Siemens SINEC NMS network management system for monitoring industrial networks is related to insufficient privilege separation. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

Malicious code in music-source-separation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a4aa4c5d893735fb71d4983056b6d254f087a4f5c82df6976e2efdab41f0c9f2 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11641 Malicious code in music-source-separation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a4aa4c5d893735fb71d4983056b6d254f087a4f5c82df6976e2efdab41f0c9f2 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Symfony 注入漏洞

Symfony is a PHP framework for web and console applications and a set of reusable PHP components from Symfony. Symfony suffers from an injection vulnerability that stems from allowing the separation of a PHP application from its global state...