CVE-2023-28586

CVE-2023-28586 concerns an information disclosure in Qualcomm-chipset TZ Secure OS when loading an ELF in a trusted execution environment (TEE). The root cause is described in sources as accessing trusted application metadata symbol addresses during ELF load, potentially exposing confidential dat...

PT-2023-21799 · Qualcomm · Qualcomm Chipsets

Name of the Vulnerable Software and Affected Versions: Qualcomm Chipsets affected versions not specified Description: The issue is related to memory corruption in UTILS when the modem processes memory-specific Diag commands with arbitrary address values as input arguments. Recommendations: At the...

The vulnerability of the “Allow Subdomains” configuration in the OAuth2 authentication platform allows a hacker to bypass security restrictions and redirect users to any arbitrary URL address.

The vulnerability of the “Allow Subdomains” configuration in the OAuth2 authentication platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and redirect users to any arbitrary URL address...

OESA-2023-1884 vim security update

Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. Vim is a highly configurable text editor built to enable efficient text editing. It is an improved version of the vi editor distributed with most UNIX systems. Securi...

Imperva Successfully Mitigates Record-Breaking DDoS Attack in Retail Industry

In the dynamic world of cybersecurity, November 13, 2023, marked a significant milestone for Imperva as we successfully mitigated the largest application-layer DDoS attack we’ve ever recorded in the retail industry. The target was a prominent Indonesian eCommerce platform, known for its diverse...

New SugarGh0st RAT targets Uzbekistan government and South Korea

Cisco Talos recently discovered a malicious campaign that likely started as early as August 2023, delivering a new remote access trojan RAT we dubbed "SugarGh0st." We found evidence suggesting the threat actor is targeting the Uzbekistan Ministry of Foreign Affairs and users in South Korea. We...

Design/Logic Flaw

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if the...

CVE-2023-49094 Symbolicator Server Side Request Forgery vulnerability

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the attacker if the...

Catalis CMS360 Security Breach

Catalis CMS360 is a content management system from Catalis, Inc. A security vulnerability exists in Catalis CMS360. An attacker could exploit the vulnerability to view sensitive files by modifying document and other identifiers in URLs...

Symbolicator Code Issue Vulnerability

Symbolicator is a symbol service for native stack traces and small dumps with symbol server support. A code issue vulnerability exists in Symbolicator versions 0.3.3 through 23.11.2, which stems from the fact that an attacker can use a specially crafted HTTP endpoint to allow Symbolicator to send...

PT-2023-31052 · Unknown · Symbolicator

Name of the Vulnerable Software and Affected Versions: Symbolicator versions prior to 23.11.2 Description: The issue allows an attacker to make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response could be reflected to the...

CVE-2023-45482

Tenda AC10 version USAC10V4.0siV16.03.10.13cn was discovered to contain a stack overflow via the urls parameter in the function getparentControllistInfo...

SUSE SLES15: libopenvswitch-2_13-0 / libovn-20_03-0 / openvswitch / etc (SUSE-SU-2023:4571-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4571-1 advisory. - CVE-2023-5366: Fixed missing masks on a final stage with ports trie bsc1216002. Tenable has extracted the preceding...

CVE-2023-5239

The Security & Malware scan by CleanTalk WordPress plugin before 2.121 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass bruteforce protection...

Mozilla: Incorrect parsing of relative URLs starting with "///"

The Mozilla Foundation Security Advisory describes this flaw as: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites...

Mozilla: Incorrect parsing of relative URLs starting with "///"

The Mozilla Foundation Security Advisory describes this flaw as: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites...

Mozilla: Incorrect parsing of relative URLs starting with "///"

The Mozilla Foundation Security Advisory describes this flaw as: Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : OpenZFS vulnerability (USN-6511-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6511-1 advisory. It was discovered that the OpenZFS sharenfs feature incorrectly handled IPv6 address data. This could result in IPv6 restrictions not being...

c-ares: Buffer Underwrite in ares_inet_net_pton()

A vulnerability was found in c-ares. This issue occurs in the aresinetnetpton function, which is vulnerable to a buffer underflow for certain ipv6 addresses. "0::00:00:00/2" in particular was found to cause an issue. C-ares only uses this function internally for configuration purposes, which woul...

SUSE CVE-2023-48235

Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the existing overflow check, because the line number becomes negative and LONGMAX - lnum will cause the overflow. Impact is low, user interactio...