‼ CVE-2023-26922 ‼
📖 Read
via "National Vulnerability Database".
SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect parameter to the \www\pages\matrix-gui-2.0 endpoint.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26261 ‼
📖 Read
via "National Vulnerability Database".
In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27088 ‼
📖 Read
via "National Vulnerability Database".
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will.📖 Read
via "National Vulnerability Database".
⚠ Serious Security: TPM 2.0 vulns – is your super-secure data at risk? ⚠
📖 Read
via "Naked Security".
Security bugs in the very code you've been told you must have to improve the security of your computer...📖 Read
via "Naked Security".
Naked Security
Serious Security: TPM 2.0 vulns – is your super-secure data at risk?
Security bugs in the very code you’ve been told you must have to improve the security of your computer…
🕴 AI-Powered 'BlackMamba' Keylogging Attack Evades Modern EDR Security 🕴
📖 Read
via "Dark Reading".
Researchers warn that polymorphic malware created with ChatGPT and other LLMs will force a reinvention of security automation.📖 Read
via "Dark Reading".
Dark Reading
AI-Powered 'BlackMamba' Keylogging Attack Evades Modern EDR Security
Researchers warn that polymorphic malware created with ChatGPT and other LLMs will force a reinvention of security automation.
🕴 Russian Influence Duo Targets Politicians, CEOs for Embarrassing Video Calls 🕴
📖 Read
via "Dark Reading".
A state-backed threat actor impersonates political figures, tricking a prime minister, a former US president, and several European mayors and MPs into video calls later used in an anti-Ukraine influence campaign.📖 Read
via "Dark Reading".
Dark Reading
Russian Influence Duo Targets Politicians, CEOs for Embarrassing Video Calls
A state-backed threat actor impersonates political figures, tricking a prime minister, a former US president, and several European mayors and MPs into video calls later used in an anti-Ukraine influence campaign.
‼ CVE-2022-46752 ‼
📖 Read
via "National Vulnerability Database".
Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1275 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability classified as problematic was found in SourceCodester Phone Shop Sales Managements System 1.0. This vulnerability affects unknown code of the file /osms/assets/plugins/jquery-validation-1.11.1/demo/captcha/index.php of the component CAPTCHA Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222598 is the identifier assigned to this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27482 ‼
📖 Read
via "National Vulnerability Database".
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.📖 Read
via "National Vulnerability Database".
🕴 40% of Global ICS Systems Attacked With Malware in 2022 🕴
📖 Read
via "Dark Reading".
Led by growth in Russia, more than 40% of global ICS systems faced malicious activity in the second half of 2022.📖 Read
via "Dark Reading".
Dark Reading
40% of Global ICS Systems Attacked With Malware in 2022
Led by growth in Russia, more than 40% of global ICS systems faced malicious activity in the second half of 2022.
‼ CVE-2023-26489 ‼
📖 Read
via "National Vulnerability Database".
wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined 33-bit effective address. This bug means that, with default codegen settings, a wasm-controlled load/store operation could read/write addresses up to 35 bits away from the base of linear memory. Due to this bug, however, addresses up to `0xffffffff * 8 + 0x7ffffffc = 36507222004 = ~34G` bytes away from the base of linear memory are possible from guest code. This means that the virtual memory 6G away from the base of linear memory up to ~34G away can be read/written by a malicious module. A guest module can, without the knowledge of the embedder, read/write memory in this region. The memory may belong to other WebAssembly instances when using the pooling allocator, for example. Affected embedders are recommended to analyze preexisting wasm modules to see if they're affected by the incorrect codegen rules and possibly correlate that with an anomalous number of traps during historical execution to locate possibly suspicious modules. The specific bug in Cranelift's x86_64 backend is that a WebAssembly address which is left-shifted by a constant amount from 1 to 3 will get folded into x86_64's addressing modes which perform shifts. For example `(i32.load (i32.shl (local.get 0) (i32.const 3)))` loads from the WebAssembly address `$local0 << 3`. When translated to Cranelift the `$local0 << 3` computation, a 32-bit value, is zero-extended to a 64-bit value and then added to the base address of linear memory. Cranelift would generate an instruction of the form `movl (%base, %local0, 8), %dst` which calculates `%base + %local0 << 3`. The bug here, however, is that the address computation happens with 64-bit values, where the `$local0 << 3` computation was supposed to be truncated to a a 32-bit value. This means that `%local0`, which can use up to 32-bits for an address, gets 3 extra bits of address space to be accessible via this `movl` instruction. The fix in Cranelift is to remove the erroneous lowering rules in the backend which handle these zero-extended expression. The above example is then translated to `movl %local0, %temp; shl $3, %temp; movl (%base, %temp), %dst` which correctly truncates the intermediate computation of `%local0 << 3` to 32-bits inside the `%temp` register which is then added to the `%base` value. Wasmtime version 4.0.1, 5.0.1, and 6.0.1 have been released and have all been patched to no longer contain the erroneous lowering rules. While updating Wasmtime is recommended, there are a number of possible workarounds that embedders can employ to mitigate this issue if updating is not possible. Note that none of these workarounds are on-by-default and require explicit configuration: 1. The `Config::static_memory_maximum_size(0)` option can be used to force all accesses to linear memory to be explicitly bounds-checked. This will perform a bounds check separately from the address-mode computation which correctly calculates the effective address of a load/store. Note that this can have a large impact on the execution performance of WebAssembly modules. 2. The `Config::static_memory_guard_size(1 << 36)` option can be used to greatly increase the guard pages placed after linear memory. This will guarantee that memory accesses up-to-34G away are guaranteed to be semantically correct by reserving unmapped memory for the instance. Note that this reserves a very large amount of virtual memory per-instances and can greatly reduce the maximum number of concurrent instances being run. 3. If using a non-x86_64 host is possible, then that will also work around this bug. This bug does not affect Wasmtime's or Cranelift's AArch64 backend, for example.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-24532 ‼
📖 Read
via "National Vulnerability Database".
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1278 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionality of the file mobil/index.php. The manipulation of the argument accesstoken leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-222608.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1276 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222599.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-1277 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222600.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-46394 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r39p0 through r41p0 before r42p0, and Avalon r41p0 before r42p0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-23760 ‼
📖 Read
via "National Vulnerability Database".
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to versions 3.8 and was fixed in versions 3.7.7, 3.6.10, 3.5.14, and 3.4.17. This vulnerability was reported via the GitHub Bug Bounty program.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-26956 ‼
📖 Read
via "National Vulnerability Database".
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27486 ‼
📖 Read
via "National Vulnerability Database".
xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism to secure clusters in XCAT, it is possible for a local root user from one node to obtain credentials to SSH to any node in any zone, except the management node of the default zone. XCAT zones are not enabled by default. Only users that use the optional zone feature are impacted. All versions of xCAT prior to xCAT 2.16.5 are vulnerable. This problem has been fixed in xCAT 2.16.5. Users making use of zones should upgrade to 2.16.5. Users unable to upgrade may mitigate the issue by disabling zones or patching the management node with the fix contained in commit `85149c37f49`.📖 Read
via "National Vulnerability Database".
👍1
‼ CVE-2023-24533 ‼
📖 Read
via "National Vulnerability Database".
Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this.📖 Read
via "National Vulnerability Database".
🕴 TSA Issues Urgent Directive to Make Aviation More Cyber Resilient 🕴
📖 Read
via "Dark Reading".
Will stricter cybersecurity requirements make flying safer? The TSA says yes, and sees it as a time-sensitive imperative.📖 Read
via "Dark Reading".
Dark Reading
TSA Issues Urgent Directive to Make Aviation More Cyber Resilient
Will stricter cybersecurity requirements make flying safer? The TSA says yes, and sees it as a time-sensitive imperative.