Command Execution Vulnerability in RG-UAC 6000-E20C of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-24567)

RG-UAC 6000-E20C is an Internet behavior management and auditing product. A command execution vulnerability exists in the RG-UAC 6000-E20C of Beijing StarNet Ruijie Network Technology Co. Ltd, which can be exploited by an attacker to gain server privileges...

Introducing CyberSecurity Asset Management 3.0 with Expanded Discovery and Cyber Risk Assessment

Qualys is re-defining attack surface management with CyberSecurity Asset Management CSAM 3.0, expanding the most comprehensive attack surface coverage on the market to include patent-pending EASM discovery and scan, passive sensing for unmanaged/untrusted devices built in to the Qualys agent, and...

idccms security vulnerabilities

Net Titanium Technology idcCMS Net Titanium IDC Cloud Management Agent System is a cloud management agent system from China's Net Titanium Technology Net Titanium Technology. A security vulnerability exists in idccms v1.35, which originates from admin/readDeal.php containing a cross-site request...

MIT krb5: Multiple Vulnerabilities

Background MIT krb5 is the free implementation of the Kerberos network authentication protocol by the Massachusetts Institute of Technology. Description Multiple vulnerabilities have been discovered in MIT krb5. Please review the CVE identifiers referenced below for details. Impact Please review...

CVE-2024-27062 nouveau: lock the client object tree.

In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mappings. 4562.099306 general protection...

CISA and Partners Release Fact Sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity

Today, CISA, in collaboration with U.S. and international partners, published a joint fact sheet, Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity. This fact sheet provides information and mitigations associated with cyber operations conducted by pro-Russia hacktivists who...

CVE

CoreSecurity Our team CoreSecurityhttps://www.coresec.co.k...

SQL Injection Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-24861)

Beijing Yisetong Technology Development Co., Ltd. is a domestic data security, network security and security services provider of three major business. A SQL injection vulnerability exists in the Data Leakage Protection DLP system of Beijing Yisetong, which can be exploited by attackers to obtain...

China Has a Controversial Plan for Brain-Computer Interfaces

China's brain-computer interface technology is catching up to the US. But it envisions a very different use case: cognitive enhancement...

Considerations for Operational Technology Cybersecurity

Operational Technology OT refers to the hardware and software used to change, monitor, or control the enterprise's physical devices, processes, and events. Unlike traditional Information Technology IT systems, OT systems directly impact the physical world. This unique characteristic of OT brings...

kernel: use-after-free in net/atm/ioctl.c

A use-after-free flaw was found in the Linux kernel's net/atm/ioctl.c ATM networking technology driver: dovccioctl in net/atm/ioctl.c is vulnerable to use-after-free due to a race condition in vccrecvmsg. This issue can allow an attacker to possibly gain unauthorized access, escalate privileges, ...

SQL Injection Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisetong Technology Development Co., Ltd (CNVD-C-2024-272015)

Yisetong Data Leakage Protection DLP is a comprehensive data security product that integrates machine learning, big data analysis, document encryption, access control, correlation analysis, data identification and other technologies. Data Leakage Protection DLP system of Beijing Yisetong Technolo...

CVE-2024-33435

Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.php backend function...

Whale Song Code

During the Cold War, the US Navy tried to make a secret code out of whale song. The basic plan was to develop coded messages from recordings of whales, dolphins, sea lions, and seals. The submarine would broadcast the noises and a computer--the Combo Signal Recognizer CSR--would detect the specif...

Command Execution Vulnerability in UFIDA NC at UFIDA Network Technology Co.

UFIDA NC is a large erp enterprise management system and e-commerce platform. A command execution vulnerability exists in UFIDA NC, which can be exploited by attackers to execute commands...

CVE-2024-33435

Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.php backend function...

SQL Injection Vulnerability in Electronic Document Security Management System (CDG) of Beijing Yisetong Technology Development Co.

Yisetong Document Security Management System is the earliest document encryption and decryption product in China based on file filtering and driving technology. The protection scope covers terminal computers Windows, Mac, and Linux system platforms, smart terminals Android, IOS, and all kinds of...

CVE-2024-33435

Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.php backend function...

CVE-2024-33435

The Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system (versions 2007-2017) is vulnerable to an Insecure Permissions vulnerability (CWE-732). A remote attacker can exploit the /manage/IPSetup.php backend function to execute arbitrar...

Fedora 40 : xen (2024-3a36322c4b)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a36322c4b advisory. update to xen-4.18.1 rebase xen.gcc12.fixes.patch remove patches now included or superceded upstream ---- x86: Register File Data Sampling XSA-452,...