INEA ME RTU

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: INEA Equipment: ME RTU Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow remote code execution. 3. TECHNICAL DETAILS 3.1 AFFECTED...

3 Key Challenges to Clarity in Threat Intelligence: 2023 Forrester Consulting Total Economic Impact™ Study

Inundated with data It would have been really cool to combine those two words to make “inundata,” but it would have been disastrous for SEO purposes. It’s all meant to kick off a conversation about the state of security organizations with regard to threat intelligence. There are several key...

ChatGPT's Data Protection Blind Spots and How Security Teams Can Solve Them

In the short time since their inception, ChatGPT and other generative AI platforms have rightfully gained the reputation of ultimate productivity boosters. However, the very same technology that enables rapid production of high-quality text on demand, can at the same time expose sensitive corpora...

chromium -- multiple vulnerabilities

Chrome Releases reports: This update includes 8 security fixes: 1429197 High CVE-2023-2133: Out of bounds memory access in Service Worker API. Reported by Rong Jian of VRI on 2023-03-30 1429201 High CVE-2023-2134: Out of bounds memory access in Service Worker API. Reported by Rong Jian of VRI on...

The vulnerability of the `elf_parser::ElfParser::get_segments` function in the `elf_parser.cpp` component of the elf file analysis software `elf-parser`, due to insufficient input validation, allows a perpetrator to cause service interruptions.

The vulnerability of the elfparser::ElfParser::getsegments function in the elfparser.cpp component of the elf file analysis software, elf-parser, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures...

Malicious code in iconfront (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 240c513249651d31b1c1f7e2f4d53fed69736ccbcd996a72e62ee73750bb868a The OpenSSF Package Analysis project identified 'iconfront' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

Burn logic issue due to lack of checking parameter 0 in burnWithReserve function

Lines of code Vulnerability details Impact The token quantity is sent to 0 and then the token is internally burned, causing a logic problem. Proof of Concept 1. burnWithReserve - reservePPM = 0 2. calculateFreedAmount call - The result is scaled by the ratio of currentReserve and minterReserve...

Position created with BNB as collateral will result in locked collateral

Lines of code Vulnerability details withdrawCollateral allows position owners to withdraw collateral from the position - as long as it is still collateralized afterwards. File: Position.sol 263: function withdrawCollateraladdress target, uint256 amount public onlyOwner noChallenge noCooldown 264:...

CVE-2023-21931

...

FANUC ROBOGUIDE-HandlingPRO

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely Vendor: FANUC Equipment: ROBOGUIDE-HandlingPRO Vulnerability: Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to read and/or overwrite files on the system running the affected...

Automating Qakbot Detection at Scale With Velociraptor

In this blog, you will learn a practical methodology to extract configuration data from recent Qakbot samples. I will provide some background on Qakbot, then walk through decode themes in an easy to visualize manner. Additionally, I'll share a Velociraptor artifact to detect and automate the deco...

APT28 Exploits Known Vulnerability To Carry Out Reconnaissance and Deploy Malware on Cisco Routers

NCSClink is external, NSA, CISA, and FBI have released a joint advisory to provide details of tactics, techniques, and procedures TTPs associated with APT28's exploitation of Cisco routers in 2021. By exploiting the vulnerability CVE-2017-6742link is external, APT28 used infrastructure to...

DFIR via XDR: How to expedite your investigations with a DFIRent approach

Rapid technological evolution requires security that is resilient, up to date and adaptable. In this article, we will cover the transformation in the field of DFIR digital forensics and incident response in the last couple years, focusing on the digital forensics' aspect and how XDR fits into the...

Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access

The Iranian threat actor known as MuddyWater is continuing its time-tested tradition of relying on legitimate remote administration tools to commandeer targeted systems. While the nation-state group has previously employed ScreenConnect, RemoteUtilities, and Syncro, a new analysis from Group-IB h...

Wireshark LISP Parser Denial of Service Vulnerability

Wireshark is a set of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display the detailed data for analysis. Wireshark suffers from a denial of service vulnerability that stems from not properly handling incoming error...

MAL-2023-1238 Malicious code in mm-docs-v-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e164ce9b5bafc633c26d087af362bfe0ae909af588fc1b193b9c79f3b956c030 The OpenSSF Package Analysis project identified 'mm-docs-v-2' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in mm-docs-v-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e164ce9b5bafc633c26d087af362bfe0ae909af588fc1b193b9c79f3b956c030 The OpenSSF Package Analysis project identified 'mm-docs-v-2' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

GVision - A Reverse Image Search App That Use Google Cloud Vision API To Detect Landmarks And Web Entities From Images, Helping You Gather Valuable Information Quickly And Easily

GVision is a reverse image search app that use Google Cloud Vision API to detect landmarks and web entities from images, helping you gather valuable information quickly and easily. About Google Cloud Vision API Google Cloud Vision API is a machine learning-powered image analysis service that...

Google Releases Urgent Chrome Update to Fix Actively Exploited Zero-Day Vulnerability

Google on Friday released out-of-band updates to resolve an actively exploited zero-day flaw in its Chrome web browser, making it the first such bug to be addressed since the start of the year. Tracked as CVE-2023-2033 , the high-severity vulnerability has been described as a type confusion issue...

Post Action Report: Bad Firewall Rule Released to WPEngine Customers Wednesday

On Wednesday afternoon a small percentage of WPEngine websites using a paid version of Wordfence experienced a 500 Internal Server Error or white screen on their sites due to an erroneous firewall rule that we released. If you have experienced this issue, please check your email which contains...