1&1 Online Storage Security Vulnerabilities

CVE-2022-42969 affecting package python-py 1.10.0-1

CVE-2022-42969 affecting package python-py 1.10.0-1. No patch is available...

CVE-2021-3672 affecting package pgbouncer 1.16.1-1

CVE-2021-3672 affecting package pgbouncer 1.16.1-1. This CVE either no longer is or was never...

CVE-2021-3773 affecting package kernel 5.10.189.1-1

CVE-2021-3773 affecting package kernel 5.10.189.1-1. No patch is available...

CVE-2022-24963 affecting package apr for versions less than 1.7.2-1

CVE-2022-24963 affecting package apr for versions less than 1.7.2-1. A patched version of the package is...

CVE-2023-29403 affecting package golang for versions less than 1.20.7-1

CVE-2023-29403 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2023-24537 affecting package golang for versions less than 1.20.7-1

CVE-2023-24537 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2023-39318 affecting package golang for versions less than 1.20.10-1

CVE-2023-39318 affecting package golang for versions less than 1.20.10-1. A patched version of the package is...

CVE-2023-45853 affecting package rubygem-mini_portile2 for versions less than 2.8.0-1

CVE-2023-45853 affecting package rubygem-mini_portile2 for versions less than 2.8.0-1. A patched version of the package is...

CVE-2023-39319 affecting package golang for versions less than 1.20.10-1

CVE-2023-39319 affecting package golang for versions less than 1.20.10-1. A patched version of the package is...

CVE-2024-24788 affecting package golang for versions less than 1.22.3-1

CVE-2024-24788 affecting package golang for versions less than 1.22.3-1. A patched version of the package is...

CVE-2023-44487 affecting package kubernetes for versions less than 1.28.3-1

CVE-2023-44487 affecting package kubernetes for versions less than 1.28.3-1. A patched version of the package is...

CVE-2023-29406 affecting package golang for versions less than 1.20.7-1

CVE-2023-29406 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2023-39323 affecting package golang for versions less than 1.20.10-1

CVE-2023-39323 affecting package golang for versions less than 1.20.10-1. A patched version of the package is...

CVE-2023-29409 affecting package golang for versions less than 1.20.7-1

CVE-2023-29409 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2023-24538 affecting package golang for versions less than 1.19.8-1

CVE-2023-24538 affecting package golang for versions less than 1.19.8-1. A patched version of the package is...

CVE-2023-29400 affecting package golang for versions less than 1.20.7-1

CVE-2023-29400 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2023-44487 affecting package coredns for versions less than 1.11.1-1

CVE-2023-44487 affecting package coredns for versions less than 1.11.1-1. A patched version of the package is...

CVE-2023-24534 affecting package golang for versions less than 1.20.7-1

CVE-2023-24534 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2023-39533 affecting package golang for versions less than 1.19.12-1

CVE-2023-39533 affecting package golang for versions less than 1.19.12-1. A patched version of the package is...

CVE-2023-24539 affecting package golang for versions less than 1.20.7-1

CVE-2023-24539 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2022-41725 affecting package golang for versions less than 1.19.5-1

CVE-2022-41725 affecting package golang for versions less than 1.19.5-1. A patched version of the package is...

CVE-2023-29405 affecting package golang for versions less than 1.20.7-1

CVE-2023-29405 affecting package golang for versions less than 1.20.7-1. A patched version of the package is...

CVE-2022-41724 affecting package golang for versions less than 1.19.6-1

CVE-2022-41724 affecting package golang for versions less than 1.19.6-1. A patched version of the package is...

Exploit for Code Injection in Apache Rocketmq

CVE-2023-33246-mitigation This project is a Maven-based...

org-mode - security update

Bulletin has no...

emacs - security update

Bulletin has no...

Exploit for CVE-2024-34102

🚨 CVE-2024-34102 Exploit Script 🚨 Description This...

CVE-2024-37371

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Open Container Initiative runc

Summary Multiple vulnerabilities in Open Container Initiative runc used by IBM InfoSphere Information Server were addressed. Vulnerability Details ** CVEID: CVE-2024-21626 DESCRIPTION: **Open Container Initiative runc could allow a remote attacker to bypass security restrictions, caused by an...

CVE-2024-37370

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the...

CVE-2024-29040

This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure TPMS_ATTEST. For the field TPM2_GENERATED magic of this structure any number can.....

Metasploit Weekly Wrap-Up 06/28/2024

Unauthenticated Command Injection in Netis Router This week's Metasploit release includes an exploit module for an unauthenticated command injection vulnerability in the Netis MW5360 router which is being tracked as CVE-2024-22729. The vulnerability stems from improper handling of the password...

CVE-2024-38528

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing limit for accepted NTS-KE connections. This allows an unauthenticated remote attacker to crash ntpd-rs when an NTS-KE server is configured. Non NTS-KE server configurations, such...

CVE-2024-38322

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: ...

CVE-2024-38322

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: ...

CVE-2024-27628

Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method...

CVE-2024-25031

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: ...

CVE-2024-25031

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: ...

Security Bulletin: PowerSC is vulnerable to security restrictions bypass and denial of service due to Curl

Summary Vulnerabilities in Curl could allow a remote attacker to bypass security restrictions (CVE-2024-2466, CVE-2024-2004, CVE-2024-2379) or cause a denial of service (CVE-2024-2398). PowerSC uses Curl as part of PowerSC Trusted Network Connect (TNC). Vulnerability Details ** CVEID:...

CVE-2024-38322 IBM Storage Defender information disclosure

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: ...

CVE-2024-38322 IBM Storage Defender information disclosure

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exposes product to brute force enumeration. IBM X-Force ID: ...

CVE-2024-25031 IBM Storage Defender information disclosure

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: ...

TEMU sued for being “dangerous malware” by Arkansas Attorney General

Chinese online shopping giant Temu is facing a lawsuit filed by State of Arkansas Attorney General Tim Griffin, alleging that the retailer's mobile app spies on users. “Temu purports to be an online shopping platform, but it is dangerous malware, surreptitiously granting itself access to...

CVE-2024-29039

tpm2 is the source repository for the Trusted Platform Module (TPM2.0) tools. This vulnerability allows attackers to manipulate tpm2_checkquote outputs by altering the TPML_PCR_SELECTION in the PCR input file. As a result, digest values are incorrectly mapped to PCR slots and banks, providing a...

Exploit for Improper Input Validation in Google Android

Exploit for CVE-2022-20186 The write up can be found...

Exploit for Improper Input Validation in Google Android

Exploit for CVE-2022-20186 The write up can be found...

Security Bulletin: Vulnerability in tqdm affects IBM Process Mining CVE-2024-34062

Summary There is a vulnerability in tqdm that could allow an local authenticated attacker to execute arbitrary code on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details ** CVEID:...

Security Bulletin: Vulnerability in Jinja affects IBM Process Mining CVE-2024-34064

Summary There is a vulnerability in Jinja that could allow an attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability....

runc vulnerable to container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

runc vulnerable to container breakout through process.cwd trickery and leaked fds in...

APM Server vulnerable to Insertion of Sensitive Information into Log File in github.com/elastic/apm-server

APM Server vulnerable to Insertion of Sensitive Information into Log File in...