14218 matches found
PT-2024-6936 · Oracle · Oracle Bi Publisher
Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 7.0.0.0.0 through 12.2.1.4.0 Description: The issue is related to a component of the Oracle BI Publisher, specifically the Web Server, and involves insufficient input validation leading to authorization bypass. Th...
Linux kernel security vulnerabilities
Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel that stems from a deadlock caused by repeated calls to clkgetrate by the i2c:lpi2c component during a transfer...
USN-6885-2 apache2 regression
USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security fixes introduced a regression when proxying requests to a HTTP/2 server. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Marc Stern discovered that the Apache HTTP Server...
CBL Mariner 2.0 Security Update: fluent-bit / nghttp2 / nodejs / nodejs18 (CVE-2024-28182)
The version of fluent-bit / nghttp2 / nodejs / nodejs18 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28182 advisory. - nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 ...
CVE-2024-6421
An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service...
PT-2024-37614 · Pepperl+Fuchs · Oit1500-F113-B12-Cb +7
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: An unauthenticated remote attacker can read out sensitive device information through an incorrectly configured FTP service. There is no information...
CVE-2023-50181
An improper access control vulnerability CWE-284 in Fortinet FortiADC version 7.4.0 through 7.4.1 and before 7.2.4 allows a read only authenticated attacker to perform some write actions via crafted HTTP or HTTPS requests...
USN-6881-1 exim4 vulnerability
It was discovered that Exim did not enforce STARTTLS sync point on client side. An attacker could possibly use this issue to perform response injection during MTA SMTP sending...
Metasploit Weekly Wrap-Up 07/05/2024
I still like to MOVEit MOVEit This week, our very own sfewer-r7 added a new exploit module that leverages an authentication bypass vulnerability in the MOVEit Transfer SFTP service CVE-2024-5806. It is possible to authenticate to the SFTP service as any user as long as a valid username is known a...
OESA-2024-1792 kernel security update
The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some...
PT-2024-28446 · Traefik +1 · Traefik +1
Name of the Vulnerable Software and Affected Versions: Traefik versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 Description: The issue allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. This occurs because HTTP/3 servers process...
Progress MOVEit Transfer 2017 < 9.0.0.201, Ipswitch MOVEit DMZ < 8.2 / 8.2 < 8.2.0.20 / 8.3 < 8.3.0.30 SQL Injection (CVE-2017-6195)
The version of Progress MOVEit Transfer, formerly Ipswitch MOVEit DMZ, installed on the remote host is affected by a pre-authentication blind SQL injection vulnerability as referenced in Progress Community article 000192008. - Ipswitch MOVEit Transfer formerly DMZ allows pre-authentication blind...
kernel: gro: fix ownership transfer
A flaw was found in the Linux kernel's Generic Receive Offload GRO feature, where packets processed with a fragment list are not properly orphaned due to incorrect handling of socket references. This vulnerability can cause system instability or kernel bugs. The issue has been fixed by making sur...
SAMSUNG Mobile devices security vulnerability
SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from Samsung South Korea. A security vulnerability exists in SAMSUNG Mobile devices SMR Jul-2024 Release 1 prior to version 1, which stems from an improper authentication issue in the MTP applicatio...
A week in security (June 24 – June 30)
Last week on Malwarebytes Labs: TEMU sued for being "dangerous malware" by Arkansas Attorney General Driving licences and other official documents leaked by authentication service used by Uber, TikTok, X, and more "Poseidon" Mac stealer distributed via Google ads Federal Reserve "breached" data m...
CVE-2024-28182
...
Progress Software Releases Security Bulletin for MOVEit Transfer
Progress Software released a security bulletin to address a vulnerability in MOVEit Transfer. A cyber threat actor could exploit this vulnerability to take control of an affected system. Users and administrators are encouraged to review the following bulletin and apply the necessary updates: MOVE...
CVE-2024-36059
Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol...
CVE-2024-36059
Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer protocol...
