JetBrains Gateway authorization issue vulnerability

JetBrains Gateway is a compact desktop application from the Czech company JetBrains. Allows you to work remotely using the JetBrains IDE, even without a download. A security vulnerability exists in JetBrains Gateway versions prior to 2022.3 that stems from the fact that a client can connect witho...

About Anomalous Data Transfer detection in InsightIDR

By Shivangi Pandey Shivangi is a Senior Product Manager for D&R at Rapid7. Data exfiltration is an unauthorized movement or transfer of data occurring on an organization’s network. This can occur when a malicious actor gains access to a corporation’s network with the intention of stealing or...

Ho, ho, no! Scams to avoid this festive season

Whether youve been naughty or nice, someone will try and stuff a scam down your chimney either way. The FBI is warning of several likely ways to be parted from your funds or logins, and were going to give some additional context along with tips to avoid these digital lumps of coal. Social media...

PT-2024-11850 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a race condition on the per-CQ variable napi work done in the Linux kernel's net component. After calling napi complete done, another CPU can start the napi...

work-wheels.co.jp Cross Site Scripting vulnerability OBB-3082388

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-11849 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.0.8-1-default Description: A crash in the slcan driver occurs due to a freed work crash. The LTP test pty03 causes this crash, resulting in a kernel NULL pointer dereference. The issue arises when the slcan's ...

work-day.co.uk Cross Site Scripting vulnerability OBB-3079831

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress WPML Multilingual CMS premium plugin access control error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WPML Multilingual CMS premium plugin 4.5.10 and earlier versions are vulnerable to an acces...

Better Cloud Security Shouldn’t Require Bigger Budgets

Stretching what you’re given How can you do more when you’re constantly being given the same or less? When security budgets don’t match the pace of the cloud operations they’re tasked with securing, the only thing to do is become an expert in the stretch. It’s hard, and you might currently be und...

Token tactics: How to prevent, detect, and respond to cloud token theft

As organizations increase their coverage of multifactor authentication MFA, threat actors have begun to move to more sophisticated techniques to allow them to compromise corporate resources without needing to satisfy MFA. Recently, the Microsoft Detection and Response Team DART has seen an increa...

Token tactics: How to prevent, detect, and respond to cloud token theft

As organizations increase their coverage of multifactor authentication MFA, threat actors have begun to move to more sophisticated techniques to allow them to compromise corporate resources without needing to satisfy MFA. Recently, the Microsoft Detection and Response Team DART has seen an increa...

kernel: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE

A flaw was found in the lpfc module in the Linux kernel. A missing release of allocated memory when an error occurs will cause a memory leak, potentially impacting system performance and resulting in a denial of service...

kernel: netfilter: flowtable: fix stuck flows on cleanup due to pending work

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1 gcstep work is stopped to disable any further stats/del requests...

kernel: ibmvnic: free reset-work-item when flushing

A memory leak flaw was found in the Linux kernel’s IBM Virtual Network Interface Controller ibmvnic driver. This issue involved not properly freeing memory associated with a reset work item when the reset work queue is flushed, causing the reset-work-item not to be deallocated. This flaw allows a...

kernel: ALSA: usb-audio: Cancel pending work at closing a MIDI substream

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio subsystem. This flaw allows a local user to cause a Denial of Service DoS through a system crash. A race condition exists when closing a USB MIDI Musical Instrument Digital Interface output substream because...

kernel: mt76: mt7921: fix crash when startup fails.

A flaw was found in the Linux kernel's MediaTek mt7921 wireless driver. When the network interface fails to initialize during startup, a scheduled reset task is not canceled before cleanup routines run. This issue can result in a use-after-free condition, where memory is accessed after being...

kernel: ibmvnic: free reset-work-item when flushing

A memory leak flaw was found in the Linux kernel’s IBM Virtual Network Interface Controller ibmvnic driver. This issue involved not properly freeing memory associated with a reset work item when the reset work queue is flushed, causing the reset-work-item not to be deallocated. This flaw allows a...

GSD-2022-1007247 x86/entry: Work around Clang __bdos() bug

x86/entry: Work around Clang bdos bug This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.150 by commit...

PT-2022-35495 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to the Bluetooth L2CAP protocol in the Linux Kernel. It involves the initialization of delayed works at l2cap chan create. The actual impact and attack plausibility ha...

PT-2022-35642 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.220 Description: The issue is related to the Bluetooth L2CAP protocol in the Linux Kernel. It involves the initialization of delayed works at the l2cap chan create function. The actual impact and attack...