#security-vulnerability

#security-vulnerability

A critical vulnerability in Apache Tomcat enables remote code execution and information disclosure, with active exploitation noted shortly after its disclosure.

Palo Alto Networks firewalls were compromised due to two security bugs, allowing attackers to deploy backdoors and malware.

A critical flaw in Windows Update allows attackers to rollback security patches, potentially exposing systems to known vulnerabilities. The flaw affects certain Windows 10 versions.

Security vulnerability discovered in TSA's login systems could let unauthorized individuals access flight crew records.

SQL injection tested by researchers confirmed serious flaws in the system allowing administrative access without proper authentication.

YubiKey devices have a vulnerability that allows cloning, discovered in the Infineon cryptographic library, affecting many models and with moderate exploit difficulty.

Google's privacy promises are compromised by vulnerabilities exposing YouTube channel email addresses.

A researcher discovered flaws in Google's People API and Gaia ID system.

Next.js vulnerability allows trivial authentication bypass, potentially exposing sensitive features to unauthorized users.

Next.js framework has a critical security flaw in its middleware that could affect millions of sites.

A high-severity vulnerability in Meta's Llama framework could allow remote code execution via deserialization of untrusted data.

Ben Sadeghipour discovered a critical security vulnerability in Facebook's ad platform, leading to a $100,000 bounty payment from Meta.

A recently patched command-injection vulnerability in Kubernetes could allow remote code execution on Windows endpoints within a cluster.

A critical vulnerability in Kubernetes Image Builder could lead to root access; it has been fixed in version 0.1.38.

Critical security flaw in Apache Struts 2 allows file upload manipulation, posing severe risks of remote code execution; immediate updates are essential.

A critical 9.9-rated unauthenticated RCE flaw is affecting GNU/Linux systems, with no fix yet despite disclosure to developers three weeks ago.

GFI KerioControl firewalls have a vulnerability (CVE-2024-52875) allowing remote code execution due to improper input sanitization, posing significant security risks.

Apache MINA's CVE-2024-52046 vulnerability could lead to remote code execution, necessitating urgent updates and careful configuration to mitigate risks.

Users of older D-Link VPN routers should replace their devices to avoid critical security vulnerabilities.

The vulnerability allows for remote code execution without authentication, raising significant security concerns.

Apache Tomcat's recent security patch fixes a critical vulnerability that could allow remote code execution, particularly in case-insensitive file systems.

Thousands of WordPress sites are unpatched against a critical vulnerability in the Hunk Companion plugin, exposing them to serious security risks.

A critical vulnerability in the Hunk Companion WordPress plugin allows attackers to install malicious plugins, which can lead to severe security breaches.

Jetpack plugin fixed a critical vulnerability that could expose user-submitted forms to logged-in users.

Over 101 versions of the Jetpack plugin were updated due to this security flaw.

A high-severity security vulnerability in LiteSpeed Cache allows unauthenticated users to gain admin access, potentially jeopardizing WordPress sites.

A vulnerability in AD/LDAP DelAuth allows username-based authentication exploiting cached keys under certain conditions.

RADIUS, a crucial network protocol, is newly vulnerable, risking control breaches across various critical infrastructure networks.

The Google Cloud Document AI service has a serious vulnerability that remains unaddressed, enabling potential data theft from Cloud Storage.

Mac users with versions before 8.10.36 of 1Password are vulnerable to a bug allowing theft of vault items.

Trytond allows report execution on restricted records, posing a security risk that requires users to upgrade immediately.

Trytond is vulnerable to zip bomb attacks due to the acceptance of compressed content from unauthenticated requests.

YubiKey 5 has a vulnerability that allows cloning if an attacker has temporary physical access.

NinjaLab has revealed a vulnerability in YubiKey 5 Series that enables cloning of the devices, posing risks mainly to sensitive users.

AMD processors have a critical firmware flaw allowing deep memory infection for decades.

Some AMD processors dating back to 2006 have a security vulnerability tracked as CVE-2023-31315, impacting models since 2020 with highly privileged execution environment issues.