Collaborate Disseminate
Progress Software has fixed a critical vulnerability (CVE-2024-6327) in its Telerik Report Server solution and is urging users to upgrade as soon as possible. About CVE-2024-6327 (and CVE-2024-6096) Telerik Report Server is an enterprise solution for s… Continue reading Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327)
A critical-severity Docker Engine vulnerability (CVE-2024-41110) may be exploited by attackers to bypass authorization plugins (AuthZ) via specially crafted API request, allowing them to perform unauthorized actions, including privilege escalation. Abo… Continue reading Docker fixes critical auth bypass flaw, again (CVE-2024-41110)
A recently fixed vulnerability (CVE-2024-36991) affecting Splunk Enterprise on Windows “is more severe than it initially appeared,” according to SonicWall’s threat researchers. Several PoC exploits have been published, including one b… Continue reading Critical Splunk flaw can be exploited to grab passwords (CVE-2024-36991)
The zero-day exploit used to leverage CVE-2024-38112, a recently patched Windows MSHTML vulnerability, was wielded by an APT group dubbed Void Banshee to deliver malware to targets in North America, Europe, and Southeast Asia, threat hunters with Trend… Continue reading Void Banshee APT exploited “lingering Windows relic” in zero-day attacks
Microsoft faces backlash from Zero Day Initiative (ZDI) and security researchers over lack of transparency in vulnerability disclosure… Continue reading ZDI Slams Microsoft for Not Crediting It in Last Week’s Patch Tuesday
This Q pertains to PCI DSS v4.0 SAQ A – previous Q&A only touched on previous versions of PCI.
Since 4.0, merchants that accept credit card payment, even if they only iframe or link to their payment provider and the rest is done on the… Continue reading PCI DSS SAQ A qualification – what counts as a ‘found’ vulnerability?
The maintainers of the Exim mail transfer agent (MTA) have fixed a critical vulnerability (CVE-2024-39929) that currently affects around 1.5 million public-facing servers and can help attackers deliver malware to users. About CVE-2024-39929 The vulnera… Continue reading Critical Exim vulnerability facilitates malware delivery (CVE-2024-39929)
CVE-2024-38112, a spoofing vulnerability in Windows MSHTML Platform for which Microsoft has released a fix on Tuesday, has likely been exploited by attackers in the wild for over a year, Check Point researcher Haifei Li has revealed. “Check Point… Continue reading Zero-day patched by Microsoft has been exploited by attackers for over a year (CVE-2024-38112)
For July 2024 Patch Tuesday, Microsoft has released security updates and patches that fix 142 CVEs, including two exploited zero-days (CVE-2024-38080, CVE-2024-38112) in Windows Hyper-V and Windows MSHTML Platform (respectively). Zero-days exploited in… Continue reading Microsoft fixes two zero-days exploited by attackers (CVE-2024-38080, CVE-2024-38112)
I need to build a tool to get list of CVE impacting specific software of a given RedHat system.
I am aware that there is online RedHat API but i does not want to go there because :
My systems do not have Internet access,
They are build in… Continue reading RedHat get list of CVE afecting specific software [closed]