279 matches found
jooby-pac4j: deserialization of untrusted data
Impact Versions after 2.x and before 3.x of io.jooby:jooby-pac4j can cause deserialization of untrusted data Patches - 2.17.0 2.x - 3.7.0 3.x Workarounds - Not using io.jooby:jooby-pac4j until it gets patches. - Check what values you put/save on session References Version 2.x:...
Security Bulletin: IBM Match 360 vulnerable through IBM WebSphere Application Server Liberty being vulnerable to information disclosure (CVE-2023-50314)
Summary IBM Match 360 is vulnerable to information disclosure from IBM WebSphere Application Server Liberty. This is affecting IBM WebSphere Application Server Liberty versions 17.0.0.3 - 24.0.0.8. IBM WebSphere Application Server Liberty could allow an attacker with access to the network to...
PT-2025-4383 · Jwk Set +1 · Jwk Set +1
Name of the Vulnerable Software and Affected Versions: JWK Set versions prior to 0.6.0 Description: The project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. However, the current behavior is to overwrite or append, which...
CVE-2024-49401
Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities...
CVE-2024-49401
Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities...
CVE-2024-49401
CVE-2024-49401 affects Samsung Mobile devices using Settings Suggestions prior to SMR Nov-2024 Release 1. The issue is due to improper input validation in Settings Suggestions, enabling a local attacker with low privileges to perform privileged activities. Impact is described as potential local p...
CVE-2024-49401
Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities...
CVE-2024-49401
Improper input validation in Settings Suggestions prior to SMR Nov-2024 Release 1 allows local attackers to launch privileged activities...
SAMSUNG Mobile devices 安全漏洞
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG Mobile devices SMR Nov-2024 Release 1 prior to version 1, which stems from Settings Suggestions containing ...
PT-2024-33512 · Unknown · Settings Suggestions
Name of the Vulnerable Software and Affected Versions: Settings Suggestions versions prior to SMR Nov-2024 Release 1 Description: The issue is related to improper input validation in Settings Suggestions, allowing local attackers to launch privileged activities. This could potentially lead to loc...
October 24, 2024—KB5044384 (OS Build 26100.2161) Preview
None None...
October 22, 2024—KB5044380 (OS Builds 22621.4391 and 22631.4391) Preview
None None...
PT-2024-9614 · Gstreamer +7 · Gstreamer +7
Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A vulnerability has been discovered in the qtdemux parse container function within qtdemux.c, related to an out-of-bounds OOB read in memory. The issue arises from the parent function qtdemux...
Meta to pay $1.4 billion over unauthorized facial recognition image capture
Texas Attorney General Ken Paxton has announced a $1.4 billion settlement with Meta to “stop the company’s practice of capturing and using the personal biometric data of millions of Texans without the authorization required by law.” The prime reason for the initial lawsuit that led to the...
Pentest-Muse-Cli - AI Assistant Tailored For Cybersecurity Professionals
Pentest Muse is an AI assistant tailored for cybersecurity professionals. It can help penetration testers brainstorm ideas, write payloads, analyze code, and perform reconnaissance. It can also take actions, execute command line codes, and iteratively solve complex tasks. Pentest Muse Web App In...
GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws
GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide targeted recommendations in an effort to avoid introducing new security issues. "Powered by GitHub Copilot and CodeQL, code scanning autofi...
[SECURITY] Fedora 40 Update: fernflower-211.7442.40-11.fc40
JIdea's decompiler is the first actually working analytical decompiler for Ja va and probably for a high-level programming language in general. Naturally it is still under development, please send your bug reports and improvement suggestions to the issue tracker...
BIT-DISCOURSE-2022-21642 Exposure of whisper participants in discourse
Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals whisper participants. The issue has been patched in stable version 2.7.13 and beta version 2.8.0.beta11. There is no workaround for this...