Aggregator

A vulnerability, which was classified as critical, has been found in Veertu Anka Build 1.42.0. This issue affects some unknown processing of the component HTTP Request Handler. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2024-41163. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as critical was found in GNOME libgsf 1.14.52. This vulnerability affects unknown code of the component Compound Document Binary File Format Parser. The manipulation leads to integer overflow. This vulnerability was named CVE-2024-36474. It is possible to launch the attack on the local host. There is no exploit available.

A vulnerability classified as critical has been found in DrayTek Vigor310 up to 4.3.2.6. This affects the function ft_payload_dns. The manipulation of the argument length leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2024-41593. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in NVIDIA CUDA Toolkit up to 12.6U1 on Windows/Linux. It has been rated as problematic. Affected by this issue is some unknown functionality of the component nvdisam. The manipulation leads to null pointer dereference. This vulnerability is handled as CVE-2024-0125. Local access is required to approach this attack. There is no exploit available.

Fake trading apps on Google Play and Apple's App Store lure victims into "pig butchering" scams that have a global reach. [...]

A vulnerability was found in Webroot SecureAnywhere Web Shield on Windows. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library wrURL.Dll. The manipulation leads to improper check for unusual conditions. This vulnerability is known as CVE-2024-7826. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in NVIDIA CUDA Toolkit up to 12.6U1 on Windows/Linux. It has been classified as problematic. Affected is an unknown function of the component nvdisam. The manipulation leads to use after free. This vulnerability is traded as CVE-2024-0124. The attack needs to be approached locally. There is no exploit available.

A vulnerability was found in Webroot SecureAnywhere Web Shield on Windows and classified as critical. This issue affects some unknown processing in the library wrUrl.Dll. The manipulation leads to type confusion. The identification of this vulnerability is CVE-2024-7825. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Webroot SecureAnywhere Web Shield on Windows and classified as critical. This vulnerability affects unknown code in the library wrUrl.Dll. The manipulation leads to type confusion. This vulnerability was named CVE-2024-7824. Attacking locally is a requirement. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in NLnet Labs Unbound up to 1.21.0. This affects an unknown part. The manipulation leads to unchecked input for loop condition. This vulnerability is uniquely identified as CVE-2024-8508. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in DrayTek Vigor310 up to 4.3.2.6. Affected by this issue is some unknown functionality of the component Vigor Management UI. The manipulation leads to same seed in pseudo-random number generator. This vulnerability is handled as CVE-2024-41594. The attack needs to be approached within the local network. There is no exploit available.

A vulnerability classified as critical was found in TEM Opera Plus FM Family Transmitter 35.45. Affected by this vulnerability is an unknown functionality of the component SNMP Module. The manipulation leads to missing authentication. This vulnerability is known as CVE-2024-41988. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic has been found in TEM Opera Plus FM Family Transmitter 35.45. Affected is an unknown function of the component HTTP Request Handler. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2024-41987. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

PoC CVE-2024-46658 - Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629

A vulnerability classified as critical was found in Health How To Boil Eggs 251333. This vulnerability affects unknown code of the component X.509 Certificate Handler. The manipulation leads to cryptographic issues. This vulnerability was named CVE-2014-7360. The attack can only be done within the local network. There is no exploit available.

AttackIQ has released a new attack graph that emulates the behaviors exhibited by the Hadooken malware during intrusions that abused misconfigurations and critical Remote Code Execution (RCE) vulnerabilities on public-facing Oracle Weblogic Servers.

The post Emulating the Surging Hadooken Malware appeared first on AttackIQ.

The post Emulating the Surging Hadooken Malware appeared first on Security Boulevard.

A vulnerability classified as critical has been found in Elsio MAPA DA MINA 0.1. This affects an unknown part of the component X.509 Certificate Handler. The manipulation leads to cryptographic issues. This vulnerability is uniquely identified as CVE-2014-7359. The attack needs to be approached within the local network. There is no exploit available.

Authors/Presenters:Bo Chen, Zhisheng Yan, Yinjie Zhang, Zhe Yang, Klara Nahrstedt

Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.

Permalink

The post USENIX NSDI ’24 -LiFteR: Unleash Learned Codecs in Video Streaming with Loose Frame Referencing appeared first on Security Boulevard.

The national Dutch police (Politie) says that a state actor was likely behind the data breach it detected last week. [...]

A vulnerability was found in concursive Vermont Powder 4.1. It has been rated as critical. Affected by this issue is some unknown functionality of the component X.509 Certificate Handler. The manipulation leads to cryptographic issues. This vulnerability is handled as CVE-2014-7358. Access to the local network is required for this attack to succeed. There is no exploit available.