3,500 Arrested in Global Operation HAECHI-IV Targeting Financial Criminals

A six-month-long international police operation codenamed HAECHI-IV has resulted in the arrests of nearly 3,500 individuals and seizures worth $300 million across 34 countries. The exercise, which took place from July through December 2023, took aim at various types of financial crimes such as...

CVE-2023-42012

An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. IBM X-Force ID: 265509...

CVE-2023-42012

An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. IBM X-Force ID: 265509...

Code injection

An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. IBM X-Force ID: 265509...

CVE-2023-42012 IBM UrbanCode Deploy denial of service

An IBM UrbanCode Deploy Agent 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts. IBM X-Force ID: 265509...

CVE-2023-47324

creationtimestamp| type| source ---|---|--- 2023-12-18 23:17:39+00:00| seen| https://t.me/ctinow/156174 2023-12-20 15:22:22+00:00| seen| https://t.me/kasraonecom/609 2024-01-10 10:41:21+00:00| seen| https://t.me/ctinow/165695...

Cybercrooks leveraging anti automation toolkit for phishing campaigns

Cybercrooks Leveraging Anti Automation Toolkit for Phishing Campaigns By Vihar Shah and Rohan Shah · December 18, 2023 Threat actors have a track record of abusing tools hosted on GitHub for malicious purposes. Last year we showed how attackers abused Python’s tarfile module. Trellix Advanced...

CVE-2023-50071

creationtimestamp| type| source ---|---|--- 2023-12-17 07:25:40+00:00| published-proof-of-concept| https://t.me/WARLOCKDARKARMYOFFICIALS/3682 2023-12-17 10:51:34+00:00| published-proof-of-concept| https://t.me/CNArsenal/1716 2023-12-17 12:43:01+00:00| published-proof-of-concept|...

GHSA-JQPC-RC7G-VF83 User accounts disclosed to unauthenticated actors on the LAN

Summary The login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Details Starting the Home Assistant 2023.12 release, the login page returns all currently active user accounts to browsing requests from the Local Area Network...

Design/Logic Flaw

Kaifa Technology WebITR is an online attendance system, it has a vulnerability in using hard-coded encryption key. An unauthenticated remote attacker can generate valid token parameter and exploit this vulnerability to access system with arbitrary user account, including administrator’s account, ...

CVE-2023-50715

Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...

Cross site request forgery (csrf)

Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...

CVE-2023-50715 User accounts disclosed to unauthenticated actors on the LAN

Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...

CVE-2023-50715

CVE-2023-50715 affects Home Assistant core. Before version 2023.12.3, the login page discloses all active user accounts to unauthenticated requests originating on the LAN; this does not occur for non-LAN or authenticated traffic. The issue is mitigated by upgrading to 2023.12.3, which includes a ...

CVE-2023-50715 User accounts disclosed to unauthenticated actors on the LAN

Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this issue. When starting the Home Assistant...

WebITR Trust Management Issues Vulnerabilities

WebITR is an online time and attendance system. WebITR version 21023 suffers from a trust management issue vulnerability that stems from the use of hard-coded encryption keys, which can be exploited by a remote attacker to generate valid token parameters, access the system with an arbitrary user...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 for OpenShift image enhancement and security update

A new image is available for Red Hat Single Sign-On 7.6.6, running on OpenShift Container Platform 3.10 and 3.11, and 4.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Microsoft Busts Black Market for 100s of Millions of Fraudulent Accounts

By Deeba Ahmed The internet's underbelly is thriving on stolen identities and fake accounts, fueling mass phishing campaigns, identity theft rings, and DDoS attacks. This is a post from HackRead.com Read the original post: Microsoft Busts Black Market for 100s of Millions of Fraudulent Accounts...

Broken Access Control

in2code/femanager is vulnerable to Broken Access Control. The vulnerability is due to the improper implementation of access control in the check edit user component. This issue can be exploited by an attacker as an authenticated user to either edit data of various frontend users or to delete...

Microsoft Takes Legal Action to Crack Down on Storm-1152's Cybercrime Network

Microsoft on Wednesday said it obtained a court order to seize infrastructure set up by a group called Storm-1152 that peddled roughly 750 million fraudulent Microsoft accounts and tools through a network of bogus websites and social media pages to other criminal actors, netting them millions of...