11811 matches found
Canada revisits decision to ban Flipper Zero
In February 2024 the Canadian government announced plans to ban the sale of the Flipper Zero, mainly because of its reported use to steal cars. The Flipper Zero is a portable device that can be used in penetration testing with a focus on wireless devices and access control systems. If that doesnt...
Logic flaw vulnerability in KingPortal client development system of Beijing Asian Control Technology Development Co. Ltd (CNVD-2024-21043)
KingPortal client development system is a pure B/S architecture for industrial monitoring web-based configuration products, is the product of the fusion of big data visualization and industrial Internet technology. KingPortal client development system of Beijing Asian Control Technology Developme...
CVE-2024-29243
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpnclientip parameter at /apply.cgi...
CVE-2024-29244
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the pincode3g parameter at /apply.cgi...
Security Bulletin: Multiple vulnerabilities exists in the IBM® SDK, Java™ Technology Edition affect IBM Tivoli Network Manager.
Summary Multiple vulnerabilities exists in IBM® SDK Java™ Technology Edition, Version 8, which is used by IBM Tivoli Network Manager IP Edition . CVE-2024-20952, CVE-2024-20918, CVE-2024-20921, CVE-2024-20919, CVE-2024-20926, CVE-2024-20945, CVE-2023-33850 Vulnerability Details CVEID:CVE-2024-209...
Security Bulletin: Vulnerability in IBM® SDK, Java™ Technology affects IBM Cloud Pak System [CVE-2022-3676]
Summary Vulnerability in IBM® SDK, Java™ Technology affect Cloud Pak System. Vulnerability Details CVEID:CVE-2022-3676 DESCRIPTION: Eclipse Openj9 could allow a remote attacker to bypass security restrictions, caused by improper runtime type check by the interface calls. By sending a...
Public AI as an Alternative to Corporate AI
This mini-essay was my contribution to a round table on Power and Governance in the Age of AI. Its nothing I havent said here before, but for anyone who hasnt read my longer essays on the topic, its a shorter introduction. The increasingly centralized control of AI is an ominous sign. When tech...
Making Sense of Operational Technology Attacks: The Past, Present, and Future
When you read reports about cyber-attacks affecting operational technology OT, it's easy to get caught up in the hype and assume every single one is sophisticated. But are OT environments all over the world really besieged by a constant barrage of complex cyber-attacks? Answering that would requi...
Shenzhen Libituo Technology LBT-T300-mini 安全漏洞
The Shenzhen Libituo Technology LBT-T300-mini is a mini-plug-in router from Shenzhen Libituo Technology China. A security vulnerability exists in the Shenzhen Libituo Technology LBT-T300-mini v1.2.9, which is caused by a buffer overflow in the pincode3g parameter in /apply.cgi...
CVE-2024-29243
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpnclientip parameter at /apply.cgi...
CVE-2024-29243
CVE-2024-29243 affects Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9, with a vulnerability in the VPN API endpoint (vpn_client_ip at /apply.cgi) that allows a buffer overflow. The Red Hat and CNNVD entries corroborate a buffer overflow condition; PT-Security notes a workaround: avoid ...
CVE-2024-29244
The CVE-2024-29244 affects Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9. It is a buffer overflow vulnerability triggered by the pin_code_3g parameter in the /apply.cgi endpoint. CVSSv3.1 base score is 5.3 (Medium) with Network attack vector, Low integrity impact, Low availability imp...
CLSA-2024-1710945589 Fix of 9 CVEs
CVE-url: https://ubuntu.com/security/CVE-2023-52449 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier Bionic update: upstream stable patchset 2018-08-29 LP: 1789666 // CVE- url: https://ubuntu.com/security/CVE-2022-20567 - l2tp: fix refcount leakage on PPPoL2TP sockets Bionic upda...
CVE-2023-46841
Recent x86 CPUs offer functionality named Control-flow Enforcement Technology CET. A sub-feature of this are Shadow Stacks CET-SS. CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses...
CVE-2023-46841
Recent x86 CPUs offer functionality named Control-flow Enforcement Technology CET. A sub-feature of this are Shadow Stacks CET-SS. CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and return addresses...
CVE-2023-46841
CVE-2023-46841 affects the Xen hypervisor CET Shadow Stacks feature. The issue arises when CET-SS replay of certain instructions during return handling misses the shadow-stack frame removal, creating a potential local impact on availability. Documents describe Xen’s interaction with shadow stacks...
Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM SDK, Java Technology Edition Quarterly CPU - Jan 2024 - Includes Oracle January 2024 CPU is vulnerable to CVE-2023-33850
Summary This bulletin covers all applicable Java SE CVEs published by Oracle as part of their January 2024 Critical Patch Update, plus CVE-2023-33850. Following IBM® Engineering Lifecycle Engineering products are vulnerable to this attack: IBM Engineering Test Management, ELM Installer...
NIST Launches Cybersecurity Framework (CSF) 2.0
On February 26, 2024, the National Institute of Standards and Technology NIST released the official 2.0 version of the Cyber Security Framework CSF...