Computer Vulnerability News

A critical vulnerability, identified as CVE-2024-46982, has been discovered in the popular Next.js framework, widely used for building full-stack web applications.  This flaw exposes websites to cache poisoning and stored cross-site scripting (XSS) attacks, posing significant risks to both user...

Researchers uncovered a critical security vulnerability in Rails applications that leverages the Bootsnap caching library. This exploit allows attackers to achieve remote code execution (RCE) by exploiting an arbitrary file write vulnerability.  The issue is particularly concerning as Bootsnap has been...

A severe security flaw has been discovered in the popular RealHomes WordPress theme and its accompanying plugin, Easy Real Estate, threatening the security of over 23,000 websites.  These vulnerabilities, classified as unauthenticated privilege escalation issues, have been assigned critical severity...

A critical security flaw in Windows File Explorer, identified as CVE-2024-38100, has been actively exploited, raising alarms across the cybersecurity community. This vulnerability, categorized as an Elevation of Privilege (EoP) issue, allows attackers to gain administrator-level access to affected systems. Vulnerability...

A newly discovered vulnerability, CVE-2024-7344, has been identified as a critical flaw in the UEFI Secure Boot mechanism, potentially impacting the majority of UEFI-based systems. This vulnerability, uncovered by researchers at ESET, allows attackers to bypass Secure Boot protections...

Ivanti addressed multiple severe vulnerabilities in its Endpoint Manager (EPM) software, potentially exposing organizations to significant data breaches. The most alarming of these flaws are four critical path traversal vulnerabilities that could allow unauthorized access to sensitive information. The vulnerabilities, identified...

A critical remote code execution (RCE) vulnerability, CVE-2024-50603, has been actively exploited in the wild, posing significant risks to cloud environments. This vulnerability affects Aviatrix Controller, a widely used cloud networking platform, and has been assigned the maximum CVSS score...

A critical vulnerability in Kerio Control, a popular firewall and Unified Threat Management (UTM) product, has been discovered that could allow attackers to execute remote code with a single click. The flaw, identified as CVE-2024-52875, affects versions 9.2.5 through 9.4.5...

A proof-of-concept (PoC) exploit code for a critical vulnerability in macOS, identified as CVE-2024-54527 has been disclosed. This vulnerability allows attackers to bypass the Transparency, Consent, and Control (TCC) protection mechanism, potentially granting unauthorized access to sensitive user data. The vulnerability,...

IBM Concert Software has been found vulnerable to multiple security flaws that could allow attackers to trigger denial-of-service (DoS) conditions, expose sensitive information, and compromise system integrity. These vulnerabilities, disclosed under several CVE identifiers, impact various versions of the...