nodejs: Permissions policies can be bypassed via process.binding

A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsync' to run arbitrary code outside of the limits defined in a...

nodejs: Permissions policies can be bypassed via process.binding

A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsync' to run arbitrary code outside of the limits defined in a...

nodejs: Permissions policies can be bypassed via process.binding

A vulnerability was found in NodeJS. This security issue occurs as the use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsync' to run arbitrary code outside of the limits defined in a...

September 26, 2023—KB5030310 (OS Build 22621.2361) Preview

None None...

Google Account Sync Vulnerability Exploited to Steal $15M

By Habiba Rashid According to reports, a Google Account Sync vulnerability was exploited to carry out a voice phishing scam that led to the theft of $15 million from Fortress Trust. This is a post from HackRead.com Read the original post: Google Account Sync Vulnerability Exploited to Steal $15M...

Inventory exposes reference to non-Sync data to an arbitrary thread

Affected versions do not enforce a Sync bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them. A caller could use this flaw to submit thread-unsafe data into inventory,...

GHSA-36XM-35QQ-795W Inventory exposes reference to non-Sync data to an arbitrary thread

Affected versions do not enforce a Sync bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them. A caller could use this flaw to submit thread-unsafe data into inventory,...

NetScaler NTP sync failure when NTP server Root Dispersion value greater that 1 second

NetScaler NTP sync failure when Root Dispersion value is larger than 1 second. Dispersion isthe maximum difference recorded between the NTP client and the NTP serverrecorded in seconds. Root Dispersion measures the maximum amount of variance between the NTP server and its known time source. If...

RUSTSEC-2023-0058 Exposes reference to non-Sync data to an arbitrary thread

Affected versions do not enforce a Sync bound on the type of caller-provided value held in the plugin registry. References to these values are made accessible to arbitrary threads other than the one that constructed them. A caller could use this flaw to submit thread-unsafe data into inventory,...

PT-2023-8925 · Qualcomm · Qualcomm Chipsets

Name of the Vulnerable Software and Affected Versions: Qualcomm chipsets affected versions not specified Description: The issue is related to memory corruption that occurs when submitting a large list of sync points in an AUX command to the IOCTL KGSL GPU AUX COMMAND. This can potentially allow a...

Attacker can DOS the sync function of RdpxV2Core which will brick critical functionality

Lines of code Vulnerability details Impact The sync function of the RdpxV2Core contract is critical for ensuring that the cached balances of the tokens in the contract are up to date. For example, all of the AMO logic involves sending tokens directly to the RdpxV2Core contract, meaning there's no...

The Rdpx V2 Core contract functionality blocking

Lines of code Vulnerability details Impact The RdpxV2Core contract functionality can be blocked as long as the contract WETH balance is less than totalWethDelegated. This can happen even without malicious activities. Proof of Concept The sync function of the RdpxV2Core contract has a special...

Wem Agents cant sync the Cache. Error: "Cache sync failed with error: SyncFailed".

Some WEM agents are unable to synchronize the WEM cache. When manually trying to sync the cache using the command - "AgentCacheUtility.exe -refreshcache" error, "Cache sync failed with error: SyncFailed" is received...

Keyboard layout sync failures due to Microsoft API limitation

Symptom 1: In a Windows Server VDA session the keyboard layout might not sync with the client keyboard layout when launching session with the "Sync only once - when the session launches" in the Citrix Workspace App Windows/Linux/Mac keyboard setting. Symptom 2: In a Windows 10/11, Windows Server...

Secure Mail - Unable to sync emails - Log Error: Caught ParserException in with Sync

Emails do not sync. Reinstalling Secure Mail does not resolve the issue. Secure Mail logs show: " 2019-07-16T10:40:23.024-0700 ",SecureMail,ERROR 2,-ActiveSyncEngine postSynchronousCommandWithData:contentType:withParser:withCommandString:withTimeout:error:,"Caught ParserException in with...

WordPress iThemes Sync Plugin <= 2.1.13 is vulnerable to Broken Access Control

Software iThemes Sync Type Plugin Vulnerable versions = 2.1.13 Fixed in 2.1.14 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40001 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID dfebd44ecd2d Credits Abdi Pranata Required privileg...

AZL-27973 CVE-2023-32559 affecting package nodejs for versions less than 16.20.2-2

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsyn...

ALPINE-CVE-2023-32559

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsyn...

DEBIAN-CVE-2023-32559

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsyn...

Privilege escalation

A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API process.binding can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding'spawnsyn...