Category: Alert Feeds

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Red Hat Security Advisory 2024-9990-03 – An update for openstack-tripleo-common and python-tripleoclient is now available for Red Hat OpenStack Platform 17.1. – Read More  – Packet Storm 

– Red Hat Security Advisory 2024-9989-03 – An update for python-webob is now available for Red Hat OpenStack Platform 17.1. – Read More  – Packet Storm 

– Red Hat Security Advisory 2024-9988-03 – An update for python-requests is now available for Red Hat OpenStack Platform 17.1. – Read More  – Packet Storm 

– GnuPG (the GNU Privacy Guard or GPG) is GNU’s tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As such, it is meant to be compatible with PGP from NAI,...

– Red Hat Security Advisory 2024-9991-03 – An update for openstack-tripleo-common and python-tripleoclient is now available for Red Hat OpenStack Platform 17.1. – Read More  – Packet Storm 

– Debian Linux Security Advisory 5817-1 – Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. – Read More  – Packet Storm 

– The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using...

– Debian Linux Security Advisory 5818-1 – Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. – Read More  – Packet Storm 

– Ubuntu Security Notice 7124-1 – Andy Boothe discovered that the Networking component of OpenJDK 23 did not properly handle access under certain circumstances. An unauthenticated attacker could possibly use this issue to cause a denial of service. It was discovered that the Hotspot component of OpenJDK 23 did not properly handle vectorization under certain circumstances. An unauthenticated attacker could possibly...

– Ubuntu Security Notice 7121-3 – Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a...

– A security-relevant race between mremap() and THP code has been discovered. Reaching the buggy code typically requires the ability to create unprivileged namespaces. The bug leads to installing physical address 0 as a page table, which is likely exploitable in several ways: For example, triggering the bug in multiple processes can probably lead to unintended page table sharing, which probably...

– Korenix JetPort 5601 version 1.2 suffers from a path traversal vulnerability. – Read More  – Packet Storm 

– SEH utnservyer Pro version 20.1.22 suffers from multiple persistent cross site scripting vulnerabilities. – Read More  – Packet Storm 

– fronsetia version 1.1 suffers from a cross site scripting vulnerability. – Read More  – Packet Storm 

– fronsetia version 1.1 suffers from an XML external entity injection vulnerability. – Read More  – Packet Storm 

– PowerVR has an issue where PVRSRVAcquireProcessHandleBase() can cause psProcessHandleBase reuse when PIDs are reused. – Read More  – Packet Storm 

– This Metasploit module exploits an improper authorization vulnerability in ProjectSend versions r1295 through r1605. The vulnerability allows an unauthenticated attacker to obtain remote code execution by enabling user registration, disabling the whitelist of allowed file extensions, and uploading a malicious PHP file to the server. – Read More  – Packet Storm 

– Qualys discovered that needrestart suffers from multiple local privilege escalation vulnerabilities that allow for root access from an unprivileged user. – Read More  – Packet Storm 

– This Metasploit module exploits vulnerabilities in OpenPrinting CUPS, which is running by default on most Linux distributions. The vulnerabilities allow an attacker on the LAN to advertise a malicious printer that triggers remote code execution when a victim sends a print job to the malicious printer. Successful exploitation requires user interaction, but no CUPS services need to be reachable via...

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– [[{“value”:” Posted by Apple Product Security via Fulldisclosure on Nov 21 APPLE-SA-11-19-2024-5 macOS Sequoia 15.1.1 macOS Sequoia 15.1.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121753. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. JavaScriptCore Available for: macOS Sequoia Impact: Processing maliciously crafted web content may...

– [[{“value”:” Posted by Qualys Security Advisory via Fulldisclosure on Nov 21 Qualys Security Advisory LPEs in needrestart (CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003) ======================================================================== Contents ======================================================================== Summary Background CVE-2024-48990 (and CVE-2024-48992) CVE-2024-48991 CVE-2024-10224 (and CVE-2024-11003) Mitigation Acknowledgments Timeline I got bugs…“}]] – Read More  – Full Disclosure 

– [[{“value”:” Posted by Apple Product Security via Fulldisclosure on Nov 21 APPLE-SA-11-19-2024-2 visionOS 2.1.1 visionOS 2.1.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121755. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. JavaScriptCore Available for: Apple Vision Pro Impact: Processing maliciously crafted web content may lead...

– [[{“value”:” Posted by Apple Product Security via Fulldisclosure on Nov 21 APPLE-SA-11-19-2024-4 iOS 17.7.2 and iPadOS 17.7.2 iOS 17.7.2 and iPadOS 17.7.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121754. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. JavaScriptCore Available for: iPhone XS and later, iPad...

– [[{“value”:” Posted by Apple Product Security via Fulldisclosure on Nov 21 APPLE-SA-11-19-2024-3 iOS 18.1.1 and iPadOS 18.1.1 iOS 18.1.1 and iPadOS 18.1.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121752. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. JavaScriptCore Available for: iPhone XS and later, iPad...

– [[{“value”:” Posted by Apple Product Security via Fulldisclosure on Nov 21 APPLE-SA-11-19-2024-1 Safari 18.1.1 Safari 18.1.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/121756. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. JavaScriptCore Available for: macOS Ventura and macOS Sonoma Impact: Processing maliciously crafted web content...

– [[{“value”:” Posted by Andrey Stoykov on Nov 21 # Exploit Title: Reflected XSS – fronsetiav1.1 # Date: 11/2024 # Exploit Author: Andrey Stoykov # Version: 1.1 # Tested on: Debian 12 # Blog: https://msecureltd.blogspot.com/2024/11/friday-fun-pentest-series-14-reflected.html Reflected XSS #1 – “show_operations.jsp” Steps to Reproduce: 1. Visit main page of the application. 2. In the input field of “WSDL Location” enter the following...

– [[{“value”:” Posted by Weber Thomas via Fulldisclosure on Nov 21 St. Pölten UAS 20241118-1 ——————————————————————————- title| Path Traversal product| Korenix JetPort 5601 vulnerable version| 1.2 fixed version| – CVE number| CVE-2024-11303 impact| High homepage| https://www.korenix.com/ found| 2024-05-24 by| P. Oberndorfer, B. Tösch, M….“}]] – Read More  – Full Disclosure 

– [[{“value”:” Posted by Weber Thomas via Fulldisclosure on Nov 21 St. Pölten UAS 20241118-0 ——————————————————————————- title| Multiple Stored Cross-Site Scripting product| SEH utnserver Pro vulnerable version| 20.1.22 fixed version| 20.1.35 CVE number| CVE-2024-11304 impact| High homepage| https://www.seh-technology.com/ found| 2024-05-24 by| P….“}]] – Read More  – Full Disclosure 

– [[{“value”:” Posted by Andrey Stoykov on Nov 21 # Exploit Title: XXE OOB – fronsetiav1.1 # Date: 11/2024 # Exploit Author: Andrey Stoykov # Version: 1.1 # Tested on: Debian 12 # Blog: https://msecureltd.blogspot.com/2024/11/friday-fun-pentest-series-15-oob-xxe.html XXE OOB Description: – It was found that the application was vulnerable XXE (XML External Entity Injection) Steps to Reproduce: 1. Add Python3 server to serve...

– [[{“value”:” Posted by Nosebeard Labs on Nov 21 Dear colleagues, Nosebeard Labs is pleased to share its latest advisory, detailing a bypass of Apple’s system wide web content filter. The HTML version of this advisory is also available at: https://nosebeard.co/advisories/nbl-001.html Warmest regards, Nosebeard Labs ## Summary Nosebeard Labs Security Advisory NBL-001 Title: Apple web content filter bypass allows unrestricted access...

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm 

– Post Content – Read More  – Packet Storm