29510 matches found
PT-2024-18678 · Cisco · Cisco Ise
Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Description: A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the...
New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers
Over 1,500 Android devices have been infected by a new strain of Android banking malware called ToxicPanda that allows threat actors to conduct fraudulent banking transactions. "ToxicPanda's main goal is to initiate money transfers from compromised devices via account takeover ATO using a...
Enel X Waybox 安全漏洞
The Enel X Waybox is a home charging station from Enel X, Inc. A security vulnerability exists in version 3.0 of the Enel X Waybox that stems from incorrect file ownership of the Privileged Services Library, which results in an attacker would be able to execute arbitrary operating system commands...
Huawei HarmonyOS 安全漏洞
Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from an Access Control Error vulnerability that stems from improper memory access in the Telephony Services module. An attacker coul...
German Police Disrupt DDoS-for-Hire Platform dstat[.]cc; Suspects Arrested
German law enforcement authorities have announced the disruption of a criminal service called dstat.cc that made it possible for other threat actors to easily mount distributed denial-of-service DDoS attacks. "The platform made such DDoS attacks accessible to a wide range of users, even those...
CVE-2024-33029 Use After Free in DSP Services
Memory corruption while handling the PDR in driver for getting the remote heap maps...
CVE-2024-33029 Use After Free in DSP Services
Memory corruption while handling the PDR in driver for getting the remote heap maps...
New FakeCall Malware Variant Hijacks Android Devices for Fraudulent Banking Calls
Cybersecurity researchers have discovered a new version of a well-known Android malware family dubbed FakeCall that employs voice phishing aka vishing techniques to trick users into parting with their personal information. "FakeCall is an extremely sophisticated Vishing attack that leverages...
RHEL 6 : jbossws-common (RHSA-2011:1303)
The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1303 advisory. The jbossws-common package provides JBoss Web Services Native, a web service framework included as part of JBoss Enterprise Web Platform. It implemen...
Magisk 安全漏洞
Magisk is a suite of open source software for customizing Android by John Wu, an individual developer. A security vulnerability exists in Magisk, which stems from the install function of ProviderInstaller.java not validating a GMS application before loading it...
Appsmith 安全漏洞
Appsmith is an open source platform for building, deploying, and maintaining on-premise applications from Appsmith Open Source. A security vulnerability exists in Appsmith prior to version 1.46 that stems from the retrieval of AWS metadata credentials via cross-site request forgery...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Base OS issues
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data v4.8.6 is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in TensorFlow [CVE-2023-33976]
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in TensorFlow, caused by a a segfault when not given a rank 2 tensor in the arrayops.upperbound function CVE-2023-33976. TensorFlow is used by our Speech Service runtimes. This...
The vulnerability of components of web conference services and applications of the Mitel MiCollab platform, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary code.
The vulnerability of the components of web conference services and the collaboration application platform Mitel MiCollab is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code...
Amazon Linux 2 : cups-filters (ALAS-2024-2656)
The version of cups-filters installed on the remote host is prior to 1.0.35-26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2656 advisory. CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality...
The vulnerability of the Suite Applications Services package of the MiCollab collaboration platform allows a perpetrator to execute cross-site scripting attacks.
The vulnerability of the Suite Applications Services package of the MiCollab collaboration platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...
The vulnerability in the web interface of the Cisco Identity Services Engine, a platform for managing network policies, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability in the web interface of the Cisco Identity Services Engine management platform for network policies relates to the lack of data encryption measures. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through a special...
CVE-2024-32946
A vulnerability in the LevelOne WBR-6012 router's firmware version R0.40e6 allows sensitive information to be transmitted in cleartext via Web and FTP services, exposing it to network sniffing attacks...
CVE-2024-28875
A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be...