graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in derive_collocated_motion_vectors

Detailed Report: https://oss-fuzz.com/testcase?key=6662197333262336 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x51b0000029c6 Crash State:...

CVE-2024-40747

The Joomla! content management system is vulnerable to Cross-Site Scripting (XSS) because various module chromes do not properly process inputs. This flaw is present in Joomla! 3.x versions prior to 3.10.20 , 4.x versions prior to 4.4.10 , and 5.x versions prior to 5.2.3 . The vulnerability allow...

CVE-2024-40747 [20250101] - Core - XSS vectors in module chromes

Various module chromes didn't properly process inputs, leading to XSS vectors...

Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public remember method in the Laravel\Pulse\Livewire\Concerns\RemembersQueries trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within t...

graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in derive_collocated_motion_vectors

Detailed Report: https://oss-fuzz.com/testcase?key=4731099328086016 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x51b00000df32 Crash State:...

GHSA-9RMP-2568-59RV rPGP Panics on Malformed Untrusted Input

During a security audit, Radically Open Security discovered several reachable edge cases which allow an attacker to trigger rpgp crashes by providing crafted data. Impact When processing malformed input, rpgp can run into Rust panics which halt the program. This can happen in the following...

Synology Surveillance Station 安全漏洞

Synology Surveillance Station is an application from Synology Inc. of China. It provides intelligent monitoring and video management tools to protect your valuable assets. A security vulnerability exists in Synology Surveillance Station versions prior to 9.2.0-11289 and 9.2.0-9289. By exploiting...

How Is API Abuse Different from Web Application Attacks by Bots?

API abuse and web application bot attacks are often confused. This is understandable, as both involve automated interactions and are usually executed by bots. Both attack vectors are prevalent; criminals are always eager to disrupt the foundations on which businesses base their operations to...

CVE-2024-44786

Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors...

PT-2024-31249 · Unknown · Meabilis Cms

Name of the Vulnerable Software and Affected Versions: Meabilis CMS version 1.0 Description: The issue allows attackers to bypass access controls and access other users' address books through unspecified vectors. Recommendations: For Meabilis CMS version 1.0, at the moment, there is no informatio...

NHIs Are the Future of Cybersecurity: Meet NHIDR

The frequency and sophistication of modern cyberattacks are surging, making it increasingly challenging for organizations to protect sensitive data and critical infrastructure. When attackers compromise a non-human identity NHI, they can swiftly exploit it to move laterally across systems,...

imagemagick:encoder_heic_fuzzer: Index-out-of-bounds in derive_collocated_motion_vectors

Project: https://github.com/imagemagick/imagemagick.git Detailed Report: https://oss-fuzz.com/testcase?key=6713319420919808 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash...

Adobe Illustrator Out-of-Bounds Write Vulnerability (CNVD-2024-47513)

Adobe Illustrator is a set of vector-based image creation software from the American company Audobee Adobe. An out-of-bounds write vulnerability exists in Adobe Illustrator, which can be exploited by an attacker to execute arbitrary code in the context of the current user...

CVE-2024-40407

A full path disclosure in Cybele Software Thinfinity Workspace before v7.0.2.113 allows attackers to obtain the root path of the application via unspecified vectors...

kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline

In the Linux kernel, the following vulnerability has been resolved: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline The absence of IRQDMOVEPCNTXT prevents immediate effectiveness of interrupt affinity reconfiguration via procfs. Instead, the change is deferred until the next...

CVE-2024-40407

A full path disclosure vulnerability exists in Cybele Software Thinfinity Workspace versions prior to v7.0.2.113 . Attackers can use unspecified vectors to obtain the root path of the application, which could be used to gain sensitive information about the application's structure. To remediate th...

Making Sense of Kubernetes Initial Access Vectors Part 1 – Control Plane

Explore Kubernetes control plane access vectors, risks, and security strategies to prevent unauthorized access and protect your clusters from potential threats...

RLSA-2024:7851 Important: .NET 6.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 6.0.135 and .NET Runtime 6.0.35...

UBUNTU-CVE-2024-47736

In the Linux kernel, the following vulnerability has been resolved: erofs: handle overlapped pclusters out of crafted images properly syzbot reported a task hang issue due to a deadlock case where it is waiting for the folio lock of a cached folio that will be used for cache I/Os. After looking...

Qnap QTS Classic Buffer Overflow (CVE-2023-23363)

A buffer copy without checking size of input vulnerability has been reported to affect QNAP operating system. If exploited, the vulnerability possibly allows remote users to execute code via unspecified vectors. We have already fixed the vulnerability in the following versions: QTS 4.3.6.2441 bui...