Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining...

ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Command Injection

ABB Cylon Aspect 3.08.01 persistenceManagerAjax.php Remote Code Execution Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...

ABB Cylon Aspect 3.08.01 networkDiagAjax.php Remote Network Utility Execution Vulnerability

ABB Cylon Aspect version 3.08.01 allows an unauthenticated attacker to perform network operations such as ping, traceroute, or nslookup on arbitrary hosts or IPs by sending a crafted GET request to networkDiagAjax.php. This could be exploited to interact with or probe internal or external systems...

CVE-2024-48644

Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera Firmware Version v3.0.0.188923031701 allows remote attackers to determine valid user accounts via login attempts. This can lead to the enumeration of user accounts and potentially facilitate other attacks, such...

Using gRPC and HTTP/2 for Cryptominer Deployment: An Unconventional Approach

In this blog entry, we discuss how malicious actors are exploiting Docker remote API servers via gRPC/h2c to deploy the cryptominer SRBMiner to facilitate their mining of XRP on Docker hosts...

Ubuntu 22.04 LTS : Linux kernel (GKE) vulnerabilities (USN-7072-2)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7072-2 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

PT-2024-33167 · Reolink · Reolink Duo 2 Wifi Camera

Name of the Vulnerable Software and Affected Versions: Reolink Duo 2 WiFi Camera version v3.0.0.1889 23031701 Description: The issue allows remote attackers to determine valid user accounts via login attempts, potentially facilitating other attacks like brute-forcing of passwords. This occurs...

Reolink Duo 2 WiFi Camera 安全漏洞

Reolink Duo 2 WiFi Camera is a camera from Reolink USA. A security vulnerability exists in Reolink Duo 2 WiFi Camera version v3.0.0.188923031701, which stems from the presence of an account enumeration vulnerability that could allow a remote attacker to determine a valid user account via a login...

ABB Cylon Aspect 3.08.01 (throttledLog.php) Unauthenticated Log Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an unauthenticated log...

Ubuntu: Security Advisory (USN-7062-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7072-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-48644

Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera Firmware Version v3.0.0.188923031701 allows remote attackers to determine valid user accounts via login attempts. This can lead to the enumeration of user accounts and potentially facilitate other attacks, such...

CVE-2024-48644

CVE-2024-48644 affects the Reolink Duo 2 WiFi Camera, firmware v3.0.0.1889_23031701. The issue is in the Login Component where the application responds differently to login attempts with valid vs invalid usernames, enabling remote accounts enumeration. This can facilitate further attacks (e.g., p...

CVE-2024-50047 smb: client: fix UAF in async decryption

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in async decryption Doing an async decryption large read crashes with a slab-use-after-free way down in the crypto API. Reproducer: mount.cifs -o ...,seal,esize=1 //srv/share /mnt dd if=/mnt/largefile...

DoS (Denial of Service) org.apache.tomcat:tomcat-coyote Dependency in Crowd Data Center and Server

This High severity org.apache.tomcat:tomcat-coyote Dependency vulnerability was introduced in versions 5.1.0, 5.2.0, 5.3.0, and 6.0.0 of Crowd Data Center and Server. This org.apache.tomcat:tomcat-coyote Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Ubuntu 24.10 : libgsf vulnerabilities (USN-7062-2)

The remote Ubuntu 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7062-2 advisory. USN-7062-1 fixed vulnerabilities in libgsf. This update provides the corresponding updates for Ubuntu 24.10. Tenable has extracted the preceding description...

macOS 12.x < 12.7.6 Multiple Vulnerabilities (120910)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.7.6. It is, therefore, affected by multiple vulnerabilities: - A segment fault SEGV flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt API. This flaw allows a...

[SECURITY] Fedora 40 Update: rust-tonic-0.12.3-1.fc40

A gRPC over HTTP/2 implementation focused on high performance, interoperability, and flexibility...

[SECURITY] Fedora 39 Update: rust-tonic-0.12.3-1.fc39

A gRPC over HTTP/2 implementation focused on high performance, interoperability, and flexibility...

Debian dla-3924 : php-horde-mime-viewer - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3924 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3924-1 [email protected] https://www.debian.org/lts/security/...