CVE-2021-2077

CVE-2021-2077 affects Oracle E-Business Suite’s Oracle iStore (Shopping Cart). Affected versions are 12.1.1–12.1.3 and 12.2.3–12.2.10. It is an easily exploitable, unauthenticated remote vulnerability over HTTP that requires user interaction to exploit and can lead to unauthorized access to sensi...

A week in security (December 21- December 27)

Last week on Malwarebytes Labs we warned our readers about not so festive social media scams, how Emotet returned just in time for Christmas, we tried out some free online games your kids are playing and here’s what happened, and our VideoBytes episode talked about what penetration testing tools...

A week in security (December 14 – December 20)

Last week on Malwarebytes Labs we kept you updated on the SolarWinds attack, we warned about the special dangers that come with the Christmas season, published a threat profile for the Egregor ransomware, warned how a lead generation scam was targeting potential Malwarebytes MSP partners, and...

Fake Cyberpunk 2077 Android App Delivering Ransomware

By Waqas It seems like the problems for Cyberpunk 2077 video game are far from over as the bogus Android app is infecting Windows and Android devices. This is a post from HackRead.com Read the original post: Fake Cyberpunk 2077 Android App Delivering Ransomware...

Cyberpunk 2077 Headaches Grow: New Spyware Found in Fake Android Download

Threat actors continue to take advantage of the hype surrounding the release of the videogame Cyberpunk 2077 in a variety of ways. The latest twist is ransomware targeting Android devices disguised as a legitimate download of the new open-world game. Kaspersky researcher Tatyana Shishkova...

'Free' Cyberpunk 2077 Downloads Lead to Data Harvesting

The hotly anticipated videogame title Cyberpunk 2077 comes out on Dec. 10, inspiring breathless countdowns from gaming publications and enthusiasts across the globe. As with all things zeitgeisty, cybercriminals are looking to cash in on the excitement, with scams that offer “free copies” while...

CVE-2020-2077

CVE-2020-2077 concerns SICK Package Analytics. The vulnerability arises from incorrect default permissions in SICK Package Analytics software, affecting versions up to and including V04.0.0, allowing an unauthorized remote attacker to read sensitive data via REST API queries. Some sources indicat...

CVE-2019-2077

CVE-2019-2077 affects Android 10’s libxaac, where a missing bounds check enables an out-of-bounds write, potentially allowing remote code execution. Evidence across sources (NVD/Red Hat/CNVD) confirms the vulnerability involves libxaac and Android 10, with exploitation requiring user interaction ...

CVE-2018-2077

...

CVE-2016-2077

CVE-2016-2077 affects VMware Workstation 11.x (pre-11.1.3) and VMware Player 7.x (pre-7.1.3) on Windows. The vulnerability arises from incorrect access to an executable file, enabling local host-OS privilege escalation through unspecified vectors. Impact: host privileges; Victims may be able to e...

KLA10814 Privilege escalation vulnerability in VMware Player and Workstation

An improper file access was found in VMware products. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally. Original advisories VMware advisory Related products VMware-Workstation VMware-Player CVE list CVE-2016-2077 critical Solution...

VMware Player 7.x < 7.1.3 Host Privilege Escalation (VMSA-2016-0005)

The version of VMware Player installed on the remote host is 7.x prior to 7.1.3. It is, therefore, affected by a privilege escalation vulnerability due to an improperly referenced executable. A local attacker can exploit this to gain elevated permissions on the host system. C Tenable Network...

OracleVM 3.2 : xen (OVMSA-2015-0068) (POODLE) (Venom)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2015-0068 for details. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

KLA10461 Security bypass vulnerability in multiple products

Using of the same certificate was found in multiple products. By exploiting this vulnerability malicious users bypass security restrictions. This vulnerability can be exploited remotely via a man-in-the-middle attack. Original advisories - Related products VisualDiscovery CVE list CVE-2015-2077...

OracleVM 3.2 : xen (OVMSA-2013-0042)

The remote OracleVM system is missing necessary patches to address critical security updates : - Other than the HVM emulation path, the PV case so far failed to check that YMM state requires SSE state to be enabled, allowing for a GP to occur upon passing the inputs to XSETBV inside the hyperviso...

OracleVM 3.1 : xen (OVMSA-2013-0043)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/xsave: properly check guest input to XSETBV Other than the HVM emulation path, the PV case so far failed to check that YMM state requires SSE state to be enabled, allowing for a GP to occur upon...

Debian DSA-3006-1 : xen - security update

Multiple security issues have been discovered in the Xen virtualisation solution which may result in information leaks or denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

openSUSE Security Update : xen (openSUSE-SU-2013:1392-1)

XEN was updated to 4.1.5 release. It fixes various bugs and security issues. Issues fixed separately from the 4.1.5 release : - bnc824676 - Failed to setup devices for vm instance when start multiple vms simultaneously - bncXXXXXX - xen: CVE-2013-XXXX: XSA-61: suppress device assignment to HVM...

Open-Xchange Security Advisory 2014-03-17

Product: Open-Xchange AppSuite Vendor: Open-Xchange GmbH Internal reference: 31065 Vulnerability type: Cross Site Scripting CWE-80 Vulnerable version: 7.4.1 and 7.4.2 Vulnerable component: frontend Report confidence: Confirmed Solution status: Fixed by Vendor Fixed version: 7.4.1-rev10, 7.4.2-rev...

CVE-2014-2077

Open-Xchange AppSuite frontend is affected by an XSS in the email subject field, due to unsafe handling of aria tags in the top bar. The vulnerability allows remote attackers to inject arbitrary script/HTML in the victim’s browser context when viewing emails. Remediation provided by the vendor fi...