Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2024-1434)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

HPESBST04611 rev.1 - Certain HPE StoreEasy Servers Using Certain Intel Processors, INTEL-SA-00960, 2024.1 IPU - Intel Xeon Processor Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1660 Storage - Prior to v2.0003-06-2024 HPE StoreEasy 1860 Storage - Prior to v2.0003-06-2024 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- |...

edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message

A security weakness was identified in EDK2, the open-source reference implementation of the UEFI specification, revealing a buffer overflow vulnerability. This vulnerability enables an unauthorized attacker within proximity on the network to transmit a specifically crafted DHCPv6 Advertise messag...

Important: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

squid: denial of service in HTTP header parser

A flaw was found in Squid. This issue may allow a remote client or remote server to trigger a denial of service when sending oversized headers in HTTP messages...

Magnet Goblin Strikes Public-Facing Servers

Summary: Magnet Goblin, characterized by its financial incentives, strategically exploits zero-day vulnerabilities within publicly accessible services by employing sophisticated malware sourced from the Nerbian family, which also includes NerbianRAT and MiniNerbian. Threat Level - Red | Actor...

APT28 Hacker Group Targeting Europe, Americas, Asia in Widespread Phishing Scheme

The Russia-linked threat actor known as APT28 has been linked to multiple ongoing phishing campaigns that employ lure documents imitating government and non-governmental organizations NGOs in Europe, the South Caucasus, Central Asia, and North and South America. "The uncovered lures include a...

CVE-2024-2294

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backupname parameter in the backuplydownloadbackup function. This makes it possible for attackers to have an account with only...

CVE-2024-2294 Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backupname parameter in the backuplydownloadbackup function. This makes it possible for attackers to have an account with only...

CVE-2024-2294

CVE-2024-2294 affects the Backuply plugin for WordPress on Windows-hosted sites. The vulnerability is a Directory Traversal via the backup_name parameter in the backuply_download_backup function, allowing an account with only activate_plugins capability to access arbitrary server files. Red Hat c...

CVE-2024-2294 Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.7 via the backupname parameter in the backuplydownloadbackup function. This makes it possible for attackers to have an account with only...

Denial Of Service (DoS)

Microsoft QUIC is vulnerable to Denial Of Service DoS. The vulnerability is caused by holding onto failed connections, leading to continuous memory consumption until exhaustion, resulting in Denial of Service. Note that this vulnerability is not exploitable on .NET-based web servers running on...

The vulnerability of the microprogramming software in the BIOS of Dell PowerEdge servers and Dell Precision Rack workstations allows a intruder to gain unauthorized access to protected information.

The vulnerability of the BIOS software on Dell PowerEdge servers and Dell Precision Rack workstations relates to the writing of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

The vulnerability of the microprogramming software in the BIOS of Dell PowerEdge servers and Dell Precision Rack workstations allows a intruder to gain unauthorized access to protected information.

The vulnerability of the BIOS software on Dell PowerEdge servers and Dell Precision Rack workstations relates to the writing of data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Ubuntu 16.04 LTS : python-cryptography vulnerability (USN-6673-2)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6673-2 advisory. USN-6673-1 provided a security update for python-cryptography. This update provides the corresponding update for Ubuntu 16.04 LTS. Tenable has extracted the...

RHEL 8 : edk2 (RHSA-2024:1305)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1305 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU a...

CVE-2024-28186 SMTP Mail Credentials Disclosed in Error Log in freescout

FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing...

edk2 security update

An update is available for edk2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

BIT-GOLANG-2024-24783 Verify panics on certificates with an unknown public key algorithm in crypto/x509

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

Microsoft OLE DB Provider for SQL Server Security Vulnerability

Microsoft OLE DB Provider for SQL Server is an API from Microsoft Corporation that allows access to data from a variety of sources in a unified way. A security vulnerability exists in Microsoft OLE DB Provider for SQL Server. An attacker could exploit the vulnerability to remotely execute code. T...