🕴 Watch Out: Attackers Are Hiding Malware in 'Browser Updates' 🕴
📖 Read
via "Dark Reading".
Updating your browser when prompted is a good practice, just make sure the notification comes from the vendor themselves.📖 Read
via "Dark Reading".
Dark Reading
Watch Out: Attackers Are Hiding Malware in 'Browser Updates'
Updating your browser when prompted is a good practice, just make sure the notification comes from the vendor themselves.
‼ CVE-2023-27133 ‼
📖 Read
via "National Vulnerability Database".
TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-2023-31068 are only about the TSplus Remote Access product, not the TSplus Remote Work product.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27132 ‼
📖 Read
via "National Vulnerability Database".
TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product.📖 Read
via "National Vulnerability Database".
🕴 UAE, US Partner to Bolster Financial Services Cybersecurity 🕴
📖 Read
via "Dark Reading".
The two countries agree to share financial services information and provide cross-border training and best practices.📖 Read
via "Dark Reading".
Dark Reading
UAE, US Partner to Bolster Financial Services Cybersecurity
The two countries agree to share financial services information and provide cross-border training and best practices.
🕴 'Etherhiding' Blockchain Technique Masks Malicious Code in WordPress Sites 🕴
📖 Read
via "Dark Reading".
The ClearFake campaign uses fake browser updates to lure victims and spread RedLine, Amadey, and Lumma stealers.📖 Read
via "Dark Reading".
Dark Reading
'Etherhiding' Blockchain Technique Masks Malicious Code in WordPress Sites
The ClearFake campaign uses fake browser updates to lure victims and spread RedLine, Amadey, and Lumma stealers.
🕴 Zero-Day Alert: Ten Thousand Cisco IOS XE Systems Now Compromised 🕴
📖 Read
via "Dark Reading".
Just a day after Cisco disclosed CVE-2023-20198, it remains unpatched, and one vendor says a Shodan scan shows at least 10,000 Cisco devices with an implant for arbitrary code execution on them. The vendor meanwhile has updated the advisory with more mitigation steps.📖 Read
via "Dark Reading".
Dark Reading
Zero-Day Alert: Thousands of Cisco IOS XE Systems Now Compromised
Just a day after Cisco disclosed CVE-2023-20198, it remains unpatched, and one vendor says a Shodan scan shows at least 10,000 Cisco devices with an implant for arbitrary code execution on them. The vendor meanwhile has updated the advisory with more mitigation…
🦿 New Netskope Report Exposes Increasing Use of Cloud Apps to Spread Malware 🦿
📖 Read
via "Tech Republic".
Microsoft OneDrive accounts for 26% of the overall usage of cloud storage apps to host malware, ahead of Microsoft PowerPoint and GitHub.📖 Read
via "Tech Republic".
TechRepublic
New Netskope Report Exposes Increasing Use of Cloud Apps to Spread Malware
This new Cloud and Threat report covers the first three quarters of 2023 and exposes the top techniques used by cyberattackers.
🕴 Amazon Quietly Wades Into the Passkey Waters 🕴
📖 Read
via "Dark Reading".
The move by the e-commerce kahuna to offer advanced authentication to its 300+ million users has the potential to move the needle on the technology's adoption, security experts say.📖 Read
via "Dark Reading".
Dark Reading
Amazon Quietly Wades Into the Passkey Waters
The move by the e-commerce kahuna to offer advanced authentication to its 300+ million users has the potential to move the needle on the technology's adoption, security experts say.
🕴 Chatbot Offers Roadmap for How to Conduct a Bio Weapons Attack 🕴
📖 Read
via "Dark Reading".
Once ethics guardrails are breached, generative AI and LLMs could become nearly unlimited in its capacity to enable evil acts, researchers warn.📖 Read
via "Dark Reading".
Dark Reading
Chatbot Offers Roadmap for How to Conduct a Bio Weapons Attack
Once ethics guardrails are breached, generative AI and LLMs could become nearly unlimited in its capacity to enable evil acts, researchers warn.
🦿 New Critical Zero-Day Vulnerability Affects Web UI of Cisco IOS XE Software & Allows Attackers to Compromise Routers 🦿
📖 Read
via "Tech Republic".
The number of devices exposing the web UI on the internet, a timeline and technical details about this malicious activity, and tips for mitigating this zero-day threat are featured.📖 Read
via "Tech Republic".
TechRepublic
New Critical Zero-Day Vulnerability Affects Web UI of Cisco IOS XE Software & Allows Attackers to Compromise Routers
This new, critical zero-day vulnerability affecting the web UI of Cisco IOS XE software is being exploited in the wild.
‼ CVE-2023-45803 ‼
📖 Read
via "National Vulnerability Database".
urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-4896 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability exists which allows an authenticated attacker to access sensitive information on the AirWave Management Platform web-based management interface. Successful exploitation allows the attacker to gain access to some data that could be further exploited to laterally access devices managed and monitored by the AirWave server.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45951 ‼
📖 Read
via "National Vulnerability Database".
lylme_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45952 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in the component ajax_link.php of lylme_spage v1.7.0 allows attackers to execute arbitrary code via uploading a crafted file.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43794 ‼
📖 Read
via "National Vulnerability Database".
Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. Since this is a blind SQL injection, an attacker may need to use time-based payloads which would include a function to delay execution for a given number of seconds. The response time indicates, whether the result of the query execution was true or false. Depending on the result, the HTTP response will be returned after a given number of seconds, indicating TRUE, or immediately, indicating FALSE. In that way, an attacker can reveal the data present in the database. This vulnerability has been addressed in version 0.111.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-141`.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-45810 ‼
📖 Read
via "National Vulnerability Database".
OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those calls are not releasing resources even after a response has been sent, and given a sufficient call volume the service as a whole becomes unresponsive. This issue has been addressed in version 1.3.4 and the upgrade is considered backwards compatible. There are no known workarounds for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22095 ‼
📖 Read
via "National Vulnerability Database".
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). The supported version that is affected is 8.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-22088 ‼
📖 Read
via "National Vulnerability Database".
Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: User Management). Supported versions that are affected are 7.4.0 and 7.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Order and Service Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Order and Service Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41631 ‼
📖 Read
via "National Vulnerability Database".
eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39279 ‼
📖 Read
via "National Vulnerability Database".
SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41715 ‼
📖 Read
via "National Vulnerability Database".
SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileges inside the tunnel.📖 Read
via "National Vulnerability Database".