-
CVE-2024-36532: Insecure permissions in kruise v1.6.2 (21 June 2024)
Preface: CNCF (Cloud Native Computing Foundation) is the open source, vendor-neutral hub of cloud native computing, hosting projects like Kubernetes and Prometheus to make cloud native universal and sustainable. Background: OpenKruise is a suite of extension components for Kubernetes that focuses on automated management of large-scale applications, such as deployment, upgrades, maintenance, and availability protection.…
-
CVE-2024-36680: Improper neutralization of SQL parameter in Promokit[.]eu – Facebook module for PrestaShop (20-June-2024)
Preface: PrestaShop is an open source e-commerce platform that emerged in 2007. It’s still widely used today—more than 250,000 devices are powered by it. The goal of PrestaShop Facebook is to promote e-commerce sales on Facebook and Instagram social networks. Background: E-commerce web designers need to create our modules folder in the root directory of…
-
CVE-2024-36977: usb: dwc3: Wait unconditionally after issuing EndXfer command (19 June 2024)
Preface: The DWC3 is Synopsys IP providing a SuperSpeed USB 3.0 controller. This Synopsys DesignWare USB3 controller IP has proved to be very popular and is in use ranging from various Arm SoCs from Samsung and TI to Qualcomm platforms. DWC3 is also used by various platforms from both Intel and AMD. Background: EN_ENDXFER_ON_RJCT_STRM: Enable…
-
CVE-2024-37079 and CVE-2024-37080: vCenter Server contains a heap-overflow vulnerability. Is this a prior incident? (18-June-2024)
Preface: The DCE/RPC protocol is the protocol for remote procedure calls. It is widely used in the modern Internet. Because the proper functioning of DCE/RPC protocols is critical to modern infrastructure and society, it is important to verify the reliability of DCE/RPC implementations. Background: This type of vulnerability can be particularly dangerous because it could…
-
CVE-2024-21478 – Automotive manufacturer staying alert! (18 June 2024)
Preface: For example, if your app defines a fence for headphones, it gets callbacks when the headphones are plugged in and when they’re unplugged. Background: Automotive infotainment is an in-car system that combines entertainment such as radio and music playing with driving information, including navigation, ADAS, and vehicle settings. The SA8255P delivers next-generation Qualcomm Snapdragon…
-
CVE-2024-4610: Arm was recently aware of this vulnerability being exploited in the wild (17 June 2024)
Arm has released limited details about the vulnerability. Do you think the following is similar to CVE-2024-4610? Preface: Arm was recently aware of reports of this vulnerability being exploited in the wild, but this exploit was a local attack. Perhaps, cybercriminals should help via email phishing or SMS functionality. Therefore, it attracted the attention of…
-
CVE-2023-20597: AGESA™ firmware versions previously provided did not sufficiently mitigate CVE-2023-20594. Release 2nd round of remedy.(13-June-2024)
Preface: June 2024 Update – After additional analysis, AMD believes that the Client AGESA™ firmware versions previously provided did not sufficiently mitigate CVE-2023-20594. This security bulletin has been updated with new Client AGESA™ firmware versions that contain updated mitigations. Background: The DXE drivers are responsible for initializing the processor, chipset, and platform components as well…
-
CVE-2024-35253: Microsoft Azure File Sync Elevation of Privilege Vulnerability (11 Jun 2024)
Preface: That is by design. If a file is created with the name of a just-deleted file, timestamps, attributes, and security are carried forward. Background: To immediately sync files that are changed in the Azure file share, the Invoke-AzStorageSyncChangeDetection PowerShell cmdlet can be used to manually initiate the detection of changes in the Azure file…
-
Repost CVE-2024-5274: Google Chrome fixed remote code execution vulnerability (11-06-2024)
CVE Release date: May 24, 2024 Preface: Every time I start learning CVE. It helps me enrich my knowledge. Even though it was released months ago. Background: Around the world in 2024, over 4450 companies have started using Chrome as Site Search tool. V8 is a JavaScript and WebAssembly engine developed by Google for its Chrome…
-
Regarding CVE-2024-0099 and CVE-2024-0084: Is this a renewed focus on vulnerabilities discovered in 2021? 10-June-2024
Original posted 06/06/2024 Preface: Oracle and Citrix have large customer bases and use Xen as their primary hypervisor. Red Hat, SUSE, and Canonical support KVM as a virtualization option in their Linux versions. When it comes to cloud computing, administrators face a similar decision: Citrix and Oracle offer Xen-based offerings rather than Google’s KVM. Background:…