In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
vantage6 is privacy preserving federated learning infrastructure. Prior to version 4.0.0, malicious users may try to get access to resources they are not allowed to see, by creating resources with integers as names. One example where this is a risk, is when users define which users are allowed to run algorithms on their node. This may be defined by username or user id. Now, for example, if user id 13 is allowed to run tasks, and an attacker creates a username with username '13', they would be wrongly…
Алгоритмы важны. Но реализовать их можно очень по-разному. При одном и том же алгоритме, оптимизированная библиотека будет в тысячу раз быстрее наивной. Любите оптимизации, специализированные структуры данных и трюки с битами? Тогда скорее под кат! Читать дальше →
SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the intranet/cgi bin/cataloging/ysearch.pl. component.
File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover-image.pl component.
An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the User Modify function in the Maintenance/Access function component.
An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component.
In tbd of tbd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
vantage6 is privacy preserving federated learning infrastructure. Versions prior to 4.0.0 use pickle, which has known security issue, as a default serialization module but that has known security issues. All users of vantage6 that post tasks with the default serialization are affected. Version 4.0.0 contains a patch. Users may specify JSON serialization as a workaround.
Всем привет! Меня зовут Максим. Я backend-разработчик, который не так давно устроился на свою первую работу. В этой статье хочу поделиться своими наблюдениями/советами/рекомендациями для начинающих программистов. Ведь, как известно, если опыт не превращён в текст, он даже не становится прошлым.Материал будет полезен тем, кто ищет первую работу или не так давно её нашёл. Примеры будут из области Python Backend, но наблюдения универсальны и спокойно перекладываются на другую область. Поехали! Читать далее