Aggregator

A vulnerability classified as critical has been found in PHPOK 5.4. Affected is the function _userlist of the file framerwork/phpok_call.php. The manipulation leads to sql injection. This vulnerability is traded as CVE-2020-21486. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as critical was found in Langchain 0.0.171. This vulnerability affects the function load_prompt. The manipulation leads to Privilege Escalation. This vulnerability was named CVE-2023-34541. The attack can only be done within the local network. There is no exploit available.

A vulnerability classified as critical was found in Netgear R6250 1.0.4.48. This vulnerability affects unknown code. The manipulation leads to buffer overflow. This vulnerability was named CVE-2023-34563. Access to the local network is required for this attack. There is no exploit available.

A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file index.php. The manipulation of the argument category_id leads to sql injection. This vulnerability is uniquely identified as CVE-2024-2077. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Linux Kernel up to 5.10.39/5.12.6. It has been declared as critical. Affected by this vulnerability is the function user_entry_size of the component RDMA. The manipulation leads to divide by zero. This vulnerability is known as CVE-2021-47080. The attack can only be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 5.12.6. Affected by this issue is the function hl_cb_kernel_create of the component gaudi. The manipulation of the argument of leads to use after free. This vulnerability is handled as CVE-2021-47081. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple visionOS. It has been rated as critical. This issue affects some unknown processing of the component Kernel Memory Handler. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2024-23265. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in Apple tvOS. Affected is an unknown function of the component Kernel Memory Handler. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2024-23265. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in libgig 4.0.0. Affected is the function gig::DimensionRegion::CreateVelocityTable of the file gig.cpp of the component gig File Handler. The manipulation as part of Application leads to memory corruption. This vulnerability is traded as CVE-2017-12951. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

​Artivion, a leading manufacturer of heart surgery medical devices, has disclosed a November 21 ransomware attack that disrupted its operations and forced it to take some systems offline. [...]

A vulnerability has been found in Rivetcode RivetTracker 1.03 and classified as critical. Affected by this vulnerability is an unknown functionality of the file torrent_functions.php. The manipulation leads to improper access controls. This vulnerability is known as CVE-2012-4993. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic has been found in SGI IRIX. Affected is the function gr_osview. The manipulation of the argument -S leads to an unknown weakness. This vulnerability is traded as CVE-2005-0465. The attack needs to be approached locally. Furthermore, there is an exploit available.

The second zero-day vulnerability found in Windows NTLM in the past two months paves the way for relay attacks and credential theft. Microsoft has no patch, but released updated NTLM cyberattack mitigation advice.

A Threat Actor Claims to have Leaked Data of Politico

A flaw in OpenWrt's Attended Sysupgrade feature used to build custom, on-demand firmware images could have allowed for the distribution of malicious firmware packages. [...]

Mr Hamza Targeted the Website of Israel Defense Forces

A Threat Actor Claims to have Leaked the Data of Arduino

A vulnerability was found in Adventnet ManageEngine NetFlow Analyzer 5 and classified as problematic. Affected by this issue is some unknown functionality of the file netflow/jspui/applicationList.jsp. The manipulation of the argument rtype leads to cross site scripting. This vulnerability is handled as CVE-2007-3593. The attack may be launched remotely. Furthermore, there is an exploit available.

在SDL的开展过程中，随着接入的产品线越来越多、安全测试工具越来越多，产出的疑似漏洞或漏洞也就会越来越多，这时候就会需要一个平台来统一管控。 从目前来看，市场上并没有出现比较出名的标品，其原因可能是各家研发基础设施和流程不同，因此有很多定制化的需求。不过还是围绕解决问题出发，一个好用的SDL平台至少需要具备： 1、安全测试工具联动，如SAST、SCA、DAST、IAST的扫描任务管理、漏洞同步、规则调优等； 2、开发安全流程线上化，如带病上线的绿色通道申请流程、安全提测加急流程、漏洞修复流程等； 3、多种角色使用的功能，如安全工程师（安全测试）、产品线领导（风险态势）、产线开发人员（漏洞修复）等。 然而，以上这些都是需要在实践之后才能做得好，这也是SDL平台的宝贵之处。 更多软件安全内容，可以访问： 1、SDL100问：我与SDL的故事 SDL与DevSecOps有何异同？ 如何在不同企业实施SDL？ SAST误报太高，如何解决？ SDL需要哪些人参与？ 在devops中做开发安全，会遇到哪些问题？ 如何实施安全需求？ 安全需求，有哪些来源？ 安全需求怎么实现自动化？ 实施安全需求，会遇到哪些难题？ 安全需求和安全设计有何异同及关联？ 设计阶段应开展哪些安全活动？ 有哪些不错的安全设计参考资料？ 安全设计要求怎么做才能落地？ 有哪些威胁建模方法论？ 有哪些威胁建模工具？ 如何开始或实施威胁建模？ 威胁建模和架构安全评审，有何异同？ 编码阶段，开展哪些安全活动？ 如何选择静态代码扫描(SAST)工具？ 如何选择开源组件安全扫描(SCA)工具？ SCA工具扫描出很多漏洞，如何处理？ SCA工具识别出高风险协议，如何处理？ 如何制定一份有用的开发安全规范？ 如何做到开发安全规范的有效实施？ 应该如何选型代码安全扫描工具？ 代码安全扫描应该设置哪些指标？ 如何提升开发人员的安全意识？ 在编码阶段加入安全检查后，如何处理带来的时间压力？ 白盒检测工具存在局限性，如何进行补偿？ SCA用什么系统做，自研还是外购？ 2、SDL创新实践系列 首发！“ 研发安全运营 ” 架构研究与实践 DevSecOps实施关键：研发安全团队 DevSecOps实施关键：研发安全流程 DevSecOps实施关键：研发安全规范 从安全视角，看研发安全 数字化转型下的研发安全痛点

A vulnerability was found in Adobe Flash Player up to 18.0.0.x. It has been rated as critical. Affected by this issue is some unknown functionality. The manipulation leads to use after free. This vulnerability is handled as CVE-2015-3107. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.