Interpol Nets $300 Million, Arrests 3,500 in Major Cyber Crime Bust

By Deeba Ahmed From NFTs to Sextortion: AI & Deepfakes Fuel New Scams Exposed in Interpol Cyber Sting - The global arrests were part of Interpol's operation HAECHI IV. This is a post from HackRead.com Read the original post: Interpol Nets $300 Million, Arrests 3,500 in Major Cyber Crime Bust...

Windows CLFS and five exploits used by ransomware operators (Exploit #3 – October 2022)

This is part four of our study about the Common Log File System CLFS and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you havent already. You can skip to the other parts using this table of...

CVE-2023-49706

Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with...

CVE-2023-49706

Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges, thereby allowing them to act as and with the permissions of another user. Attackers must generate repeated API requests to trigger a race condition with...

CVE-2023-49706

LinOTP Self Service in LinOTP 3.x prior to 3.2.5 is affected by a race-condition in defective request context handling that can be exploited by remote, unauthenticated attackers to escalate privileges and act with another user’s permissions. Attack requires generating repeated API requests to tri...

AZL-36944 CVE-2023-48795 affecting package jsch 0.1.55-3

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-32225 CVE-2023-48795 affecting package packer for versions less than 1.9.5-3

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

SUSE SLES15: kernel-livepatch-5_14_21-150400_15_5-rt / etc (SUSE-SU-2023:4848-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4848-1 advisory. This update for the Linux Kernel 5.14.21-150400155 fixes several issues. The following security issues were fixed: - CVE-2023-3610: Fixed...

CVE-2023-6569

External Control of File Name or Path in h2oai/h2o-3...

CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3

External Control of File Name or Path in h2oai/h2o-3...

CVE-2023-6569

The CVE-2023-6569 entry concerns h2oai/h2o-3 with a vulnerability labeled as External Control of File Name or Path. Connected sources describe a remote, unauthenticated possibility for an attacker to overwrite arbitrary server files with attacker-controlled data; in the GHSA advisory this involve...

CVE-2023-6569 External Control of File Name or Path in h2oai/h2o-3

External Control of File Name or Path in h2oai/h2o-3...

Ubuntu: Security Advisory (USN-6534-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-30183 · Apache +3 · Apache Shiro +3

Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.13.0 Apache Shiro versions 2.0.0-alpha-1 through 2.0.0-alpha-3 Description: The issue is related to a URL Redirection to Untrusted Site 'Open Redirect' vulnerability when "form" authentication is used in Apach...

Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (Low Latency) vulnerabilities (USN-6549-3)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6549-3 advisory. It was discovered that the USB subsystem in the Linux kernel contained a race condition while handling device descriptors in certain...

CVE-2023-50247

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack quicly, as used by H2O up to commit 43f86e5 in version 2.3.0-beta and prior, is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivel...

CVE-2023-50247

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack quicly, as used by H2O up to commit 43f86e5 in version 2.3.0-beta and prior, is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivel...

Memory corruption

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack quicly, as used by H2O up to commit 43f86e5 in version 2.3.0-beta and prior, is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivel...

CVE-2023-50247

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack quicly, as used by H2O up to commit 43f86e5 in version 2.3.0-beta and prior, is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivel...

CVE-2023-50247 h2o QUIC state exhaustion DoS

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack quicly, as used by H2O up to commit 43f86e5 in version 2.3.0-beta and prior, is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivel...