PT-2024-16127 · Vagrant · Vagrant Vmware Utility

Name of the Vulnerable Software and Affected Versions: Vagrant VMWare Utility version 1.0.23 and earlier Description: The Vagrant VMWare Utility Windows installer has a non-protected path that could be modified by an unprivileged user, introducing potential for unauthorized file system writes...

Vagrant VMWare Utility 安全漏洞

HashiCorp Vagrant VMware Utility is a utility service from HashiCorp USA. A security vulnerability exists in Vagrant VMWare Utility version 1.0.22 and earlier, which originates from the Windows installer using an unprotected path against a custom location, which could be modified by an unauthoriz...

Huawei EulerOS: Security Advisory for qemu (EulerOS-SA-2024-2746)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ABB Cylon Aspect 3.08.01 networkDiagAjax.php Remote Network Utility Execution Vulnerability

ABB Cylon Aspect version 3.08.01 allows an unauthenticated attacker to perform network operations such as ping, traceroute, or nslookup on arbitrary hosts or IPs by sending a crafted GET request to networkDiagAjax.php. This could be exploited to interact with or probe internal or external systems...

[SECURITY] Fedora 39 Update: apache-commons-io-2.11.0-5.fc39

Commons-IO contains utility classes, stream implementations, file filters, and endian classes. It is a library of utilities to assist with developing IO functionality...

Microsoft Reveals macOS Vulnerability that Bypasses Privacy Controls in Safari Browser

Microsoft has disclosed details about a now-patched security flaw in Apple's Transparency, Consent, and Control TCC framework in macOS that has likely come under exploitation to get around a user's privacy preferences and access data. The shortcoming, codenamed HM Surf by the tech giant, is track...

VDA Installer Only Displays Splash Screen then Closes

When installing the workstation VDA, the Installer Splash Screen appears for a second then disappears. Nothing is logged in the installer logs There are no crashes reported in the eventlogs DebugView shows the installer exits with status Code: 1 Using the Citrix VDA Cleanup Utility Tool does not...

ABB Cylon Aspect 3.08.01 (networkDiagAjax.php) Remote Network Utility Execution

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The vulnerability allows an unauthenticated attacker to perform netwo...

ABB Cylon Aspect 3.08.01 networkDiagAjax.php Remote Network Utility Execution

ABB Cylon Aspect 3.08.01 networkDiagAjax.php Remote Network Utility Execution Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...

Teltonika Remote Management System and RUT Model Routers External Control of System or Configuration Setting (CVE-2023-32349)

Version 00.07.03.4 and prior of Teltonika's RUT router firmware contain a packet dump utility that contains proper validation for filter parameters. However, variables for validation checks are stored in an external configuration file. An authenticated attacker could use an exposed UCI...

CISA Warns of Threat Actors Exploiting F5 BIG-IP Cookies for Network Reconnaissance

The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning that it has observed threat actors leveraging unencrypted persistent cookies managed by the F5 BIG-IP Local Traffic Manager LTM module to conduct reconnaissance of target networks. It said the module is being used to...

Large scale Google Ads campaign targets utility software

After what seemed like a long hiatus, we've observed threat actors returning to malvertising to drop malware disguised as software downloads. The campaign we identified is high-impact, going after utility software such as Slack, Notion, Calendly, Odoo, Basecamp, and others. For this blog, we...

The vulnerability of the performance and status collection utility in HP One Agent, a microprogramming software for HP laptops, allows attackers to enhance their privileges.

The vulnerability of the HP One Agent performance and status monitoring tool for laptop HP microcomputer software involves the use of an unreliable search path. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2024-43693

A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary commands...

CVE-2024-43693

The CVE-2024-43693 vulnerability affects Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE (and related LX4 variants) where a specially crafted POST request to the CONSOLE UTILITY sub-menu enables remote command injection. This is a network‑reachable flaw with low attack complexity and no user ...

PT-2024-30620 · Unknown · Progauge Maglink Lx Console

Name of the Vulnerable Software and Affected Versions: ProGauge MAGLINK LX CONSOLE affected versions not specified Description: A specially crafted POST request to the "UTILITY sub-menu" can allow a remote attacker to inject arbitrary commands. This issue affects the ProGauge MAGLINK LX CONSOLE,...

PT-2024-40583 · Graphql · Graphql

Name of the Vulnerable Software and Affected Versions: graphql affected versions not specified Description: The issue is related to a security exception in the graphql schema. Specifically, the problem occurs in the simplePrint function of GraphQLTypeUtil. This function is called multiple times,...

[SECURITY] Fedora 39 Update: less-633-4.fc39

The less utility is a text file browser that resembles more, but has more capabilities. Less allows you to move backwards in the file as well as forwards. Since less doesn't have to read the entire input file before it starts, less starts up more quickly than text editors for example, vi. You...

file: Stack Buffer Overread

Background The file utility attempts to identify a file’s format by scanning binary data for patterns. Description Multiple vulnerabilities have been discovered in file. Please review the CVE identifiers referenced below for details. Impact File has an stack-based buffer over-read in filecopystr ...

keycloak-saml-core: Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...