‼ CVE-2023-45802 ‼
📖 Read
via "National Vulnerability Database".
When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that.This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out.Users are recommended to upgrade to version 2.4.58, which fixes the issue.📖 Read
via "National Vulnerability Database".
♟️ NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison ♟️
📖 Read
via "Krebs on Security".
A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. Patrick McGovern-Allen was the subject of a Sept. 4, 2022 story here about the emergence of "violence-as-a-service" offerings, where random people from the Internet hire themselves out to perform a variety of local, physical attacks, including firebombing a home, "bricking" windows, slashing tires, or performing a drive-by shooting at someone's residence.📖 Read
via "Krebs on Security".
Krebs on Security
NJ Man Hired Online to Firebomb, Shoot at Homes Gets 13 Years in Prison
A 22-year-old New Jersey man has been sentenced to more than 13 years in prison for participating in a firebombing and a shooting at homes in Pennsylvania last year. Patrick McGovern-Allen was the subject of a Sept. 4, 2022 story…
🕴 Telling Small Businesses to Buy Cyber Insurance Isn't Enough 🕴
📖 Read
via "Dark Reading".
To protect themselves from threats, companies also need proactive cybersecurity.📖 Read
via "Dark Reading".
Dark Reading
Telling Small Businesses to Buy Cyber Insurance Isn't Enough
To protect themselves from threats, companies also need proactive cybersecurity.
‼ CVE-2023-5246 ‼
📖 Read
via "National Vulnerability Database".
Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially impact the availabilty, integrity and confidentaility of the gateways via an authentication bypass by capture-replay.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43065 ‼
📖 Read
via "National Vulnerability Database".
Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability. A low-privileged authenticated attacker can exploit these issues to obtain escalated privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26737 ‼
📖 Read
via "National Vulnerability Database".
The Zscaler Client Connector for macOS prior to 3.6 did not sufficiently validate RPC clients. A local adversary without sufficient privileges may be able to shutdown the Zscaler tunnel by exploiting a race condition.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28796 ‼
📖 Read
via "National Vulnerability Database".
Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28804 ‼
📖 Read
via "National Vulnerability Database".
An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43074 ‼
📖 Read
via "National Vulnerability Database".
Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by crafting arbitrary files through a request to the server.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26738 ‼
📖 Read
via "National Vulnerability Database".
Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28797 ‼
📖 Read
via "National Vulnerability Database".
Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26734 ‼
📖 Read
via "National Vulnerability Database".
Zscaler Client Connector Installer on Windows before version 3.4.0.124 improperly handled directory junctions during uninstallation. A local adversary may be able to delete folders in an elevated context.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28805 ‼
📖 Read
via "National Vulnerability Database".
An Improper Input Validation vulnerability in Zscaler Client Connector on Linux allows Privilege Escalation. This issue affects Client Connector: before 1.4.0.105📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42295 ‼
📖 Read
via "National Vulnerability Database".
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_rle_image function of file bifs/unquantize.c📖 Read
via "National Vulnerability Database".
‼ CVE-2023-46127 ‼
📖 Read
via "National Vulnerability Database".
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28803 ‼
📖 Read
via "National Vulnerability Database".
An authentication bypass by spoofing of a device with a synthetic IP address is possible in Zscaler Client Connector on Windows, allowing a functionality bypass. This issue affects Client Connector: before 3.9.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28793 ‼
📖 Read
via "National Vulnerability Database".
Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5718 ‼
📖 Read
via "National Vulnerability Database".
The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. By creating a malicious web page with an iFrame targeting a sensitive resource (i.e. a locally accessible file or sensitive website), and registering a listener on the web page, the extension sent messages back to the listener, containing the base64 encoded screenshot data of the sensitive resource.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26736 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the Zscaler Client Connector Installer and Uninstaller for Windows prior to 3.6 allowed execution of binaries from a low privileged path. A local adversary may be able to execute code with SYSTEM privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-28795 ‼
📖 Read
via "National Vulnerability Database".
Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26735 ‼
📖 Read
via "National Vulnerability Database".
The Zscaler Client Connector Installer and Unsintallers for Windows prior to 3.6 had an unquoted search path vulnerability. A local adversary may be able to execute code with SYSTEM privileges.📖 Read
via "National Vulnerability Database".