High-Severity Flaw Archives

Chrome Targeted by Active In-the-Wild Exploit Tied to Undisclosed High-Severity Flaw

11Dec

By RBNo Comments

News

Chrome Targeted by Active In-the-Wild Exploit Tied to Undisclosed High-Severity Flaw

Google released security patches for its Chrome browser on Wednesday to fix three security holes, one of which it said had been being exploited in the wild. The high-severity vulnerability is being monitored with the Chromium issue tracker ID "466192044." In contrast to past disclosures, Google has chosen to withhold details regarding the nature of the defect, the impacted component, and the CVE identifier. The problem is found in Google's open-source Almost Native Graphics Layer Engine (ANGLE) library, according to a GitHub commit matching the Chromium bug ID. The commit note reads, "Metal: Don't use pixelsDepthPitch to size buffers." GL_UNPACK_IMAGE_HEIGHT, which may be less than the picture height, is the basis for pixelsDepthPitch. This suggests that the issue is probably a b...

High-Severity Flaw in Allows Hackers to Exploit Environment Variables

A high-severity security hole in the PostgreSQL open-source database system has been discovered by cybersecurity researchers. This flaw might allow unauthorized users to change environment variables, which could result in code execution or information leakage. The issue has a CVSS score of 8.8 and is tracked as CVE-2024-10979. Without requiring them to be hard-coded, environment variables are user-defined values that enable a program to dynamically get different types of data during runtime, including software installation paths and access keys. They are initialized during the startup phase of some operating systems. An unprivileged database user can alter sensitive process environment variables read more about High-Severity Flaw in PostgreSQL Allows Hackers to Exploit Environmen...

Apache OFBiz Update Fixes High-Severity Flaw Leading to Remote Code Execution

The open-source enterprise resource planning (ERP) system Apache OFBiz has a newly discovered security vulnerability that, if successfully exploited, might result in unauthenticated remote code execution on Windows and Linux. This high-severity vulnerability impacts all software versions prior to 18.12.16 and is tracked as CVE-2024-45195 (CVSS score: 7.5). In a recent article, Rapid7 security researcher Ryan Emmons stated that an attacker without legitimate credentials might execute arbitrary code on the server by taking advantage of the web application's lack of view authorization checks. Note that CVE-2024-45195 is a workaround for a series of problems that the project maintainers have been addressing over the last few months read more about Apache OFBiz Update Fixes High-Sever...