Aggregator

A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type conversion. The identification of this vulnerability is CVE-2022-3979. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Das U-Boot 2022.01 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to buffer overflow. This vulnerability is known as CVE-2022-30790. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability was found in Das U-Boot up to 2022.07-rc5. It has been rated as critical. Affected by this issue is the function do_i2c_md of the component i2c md Command Handler. The manipulation leads to stack-based buffer overflow. This vulnerability is handled as CVE-2022-34835. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Das U-Boot up to 2022.07-rc3. It has been rated as critical. Affected by this issue is the function sqfs_readdir. The manipulation leads to out-of-bounds write. This vulnerability is handled as CVE-2022-33103. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability, which was classified as critical, has been found in U-Boot up to 2022.07-rc5. This issue affects some unknown processing of the component Squashfs Handler. The manipulation leads to heap-based buffer overflow. The identification of this vulnerability is CVE-2022-33967. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Das U-Boot up to 2019.07 and classified as critical. This issue affects the function nfs_lookup_reply. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2019-14196. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in Das U-Boot up to 2022.04/2022.07-rc2 and classified as critical. This issue affects the function nfs_lookup_reply of the file net/nfs.c of the component Incorrect Fix CVE-2019-14196. The manipulation leads to buffer overflow. The identification of this vulnerability is CVE-2022-30767. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as critical, was found in Das U-Boot 2022.01. Affected is an unknown function. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-2022-30552. The attack can only be done within the local network. There is no exploit available.

A vulnerability was found in Linux Kernel up to 6.6.50/6.10.9 and classified as critical. This issue affects the function smb2_set_path_size of the component SMB Client. The manipulation leads to use after free. The identification of this vulnerability is CVE-2024-46796. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Linux Kernel up to 6.6.50/6.10.9. This affects the function smb2_rename_path of the component SMB Client. The manipulation leads to use after free. This vulnerability is uniquely identified as CVE-2024-46736. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

微软宣布，有五年历史的 Xbox Series 系列游戏机以及手柄涨价最多 80-100 美元，而 Xbox 第一方游戏新作的价格也将在任天堂 Switch 2 游戏之后提高至 80 美元。硬件价格的上涨即时生效，游戏价格上涨则要到年底才会实施。微软表示，价格上涨的决定是在市场环境和不断上升的开发成本等因素下做出的。

Alleged Sale of 6 Million Indian Personal Information

Zimperium, this week during the 2025 RSA Conference, shared an analysis of mobile computing environments that finds more than 60% of iOS and 34% of Android apps lack basic code protection, with nearly 60% of iOS and 43% of Android apps also vulnerable to leaking personally identifiable information (PII).

The post Report Exposes Soft Security Underbelly of Mobile Computing appeared first on Security Boulevard.

A vulnerability, which was classified as critical, was found in Apple iOS up to 10.3.2. This affects an unknown part of the component WebKit. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2017-7042. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Authors/Presenters: Arun Vishwanath

Our sincere appreciation to BSidesLV, and the Presenters/Authors for publishing their erudite Security BSidesLV24 content. Originating from the conference’s events located at the Tuscany Suites & Casino; and via the organizations YouTube channel.

Permalink

The post BSidesLV24 – Ground Truth – I Won’t Allow My Child To Have A Smartphone: Why Smart Parents Make Not So Smart Children appeared first on Security Boulevard.

A large-scale phishing campaign using DarkWatchman and Sheriff malware has been observed targeting companies in Russia and Ukraine

多邻国声称使用生成式 AI，共享内容系统和内部工具将课程数量翻了一番。多邻国新增了 148 门新语言课程，这标志着该平台七种最受欢迎​​的非英语语言——西班牙语、法语、德语、意大利语、日语、韩语和中文普通话——将提供给所有 28 种支持的用户界面 (UI) 语言，极大地扩展了全球逾 10 亿潜在学习者的学习选择。

A vulnerability was found in Checkmk up to 1.6.0p27/2.0.0p19 and classified as problematic. This issue affects some unknown processing of the component Predefined Condition Handler. The manipulation of the argument Title leads to cross site scripting. The identification of this vulnerability is CVE-2022-24566. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Security Audit Plugin up to 1.0.0 on WordPress. This affects an unknown part of the component Setting Handler. The manipulation of the argument Data Id leads to cross site scripting. This vulnerability is uniquely identified as CVE-2021-24901. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability has been found in D-Link DIR850 ET850-1.08TRb03 and classified as critical. This vulnerability affects unknown code of the component URL Handler. The manipulation leads to open redirect. This vulnerability was named CVE-2021-46379. The attack can only be initiated within the local network. Furthermore, there is an exploit available.