Read Time:4 Second
These attacks did not exploit a vulnerability but instead leveraged weaker authentication methods
Daily Archives: May 28, 2024
USN-6792-1: Flask-Security vulnerability
Read Time:6 Second
Naom Moshe discovered that Flask-Security incorrectly validated URLs. An attacker could use this issue to redirect users to arbitrary URLs.
XSS Vulnerabilities Found in WordPress Plugin Slider Revolution
Read Time:5 Second
Slider Revolution is a widely used premium WordPress plugin with over 9 million active users
USN-6794-1: FRR vulnerabilities
Read Time:11 Second
It was discovered that FRR incorrectly handled certain malformed BGP and
OSPF packets. A remote attacker could use this issue to cause FRR to crash,
resulting in a denial of service, or possibly execute arbitrary code.
tomcat-9.0.89-1.fc39
Read Time:17 Second
FEDORA-2024-2bf73514cd
Packages in this update:
tomcat-9.0.89-1.fc39
Update description:
This update includes a rebase from 9.0.83 to 9.0.89.
#2269611 CVE-2024-24549 tomcat: CVE-2024-24549: Apache Tomcat: HTTP/2 header handling DoS
#2269612 CVE-2024-23672 tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake
USN-6793-1: Git vulnerabilities
Read Time:46 Second
It was discovered that Git incorrectly handled certain submodules.
An attacker could possibly use this issue to execute arbitrary code.
This issue was fixed in Ubuntu 22.04 LTS, Ubuntu 23.10 and Ubuntu 24.04 LTS.
(CVE-2024-32002)
It was discovered that Git incorrectly handled certain cloned repositories.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-32004)
It was discovered that Git incorrectly handled local clones with hardlinked
files/directories. An attacker could possibly use this issue to place a
specialized repository on their target’s local system. (CVE-2024-32020)
It was discovered that Git incorrectly handled certain symlinks. An attacker
could possibly use this issue to impact availability and integrity
creating hardlinked arbitrary files into users repository’s objects/directory.
(CVE-2024-32021)
It was discovered that Git incorrectly handled certain cloned repositories.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2024-32465)
USN-6787-1: Jinja2 vulnerability
Read Time:12 Second
It was discovered that Jinja2 incorrectly handled certain HTML attributes
that were accepted by the xmlattr filter. An attacker could use this issue
to inject arbitrary HTML attribute keys and values to potentially execute
a cross-site scripting (XSS) attack.
TeaBot Banking Trojan Activity on the Rise, Zscaler Observes
Read Time:5 Second
Researchers from Zscaler ThreatLabz observed an uptick in the TeaBot Andoird banking Trojan, also known as Anatsa
Courtroom Recording Software Vulnerable to Backdoor Attacks
Read Time:8 Second
Rapid7 warned that users of Justice AV Solutions (JAVS) Viewer v8.3.7 recording software are at high risk of stolen credentials and having malware installed
USN-6791-1: Unbound vulnerability
Read Time:10 Second
It was discovered that Unbound could take part in a denial of service
amplification attack known as DNSBomb. This update introduces certain
resource limits to make the impact from Unbound significantly lower.