14395 matches found
CVE-2022-41914 Non-constant-time SCIM token comparison in Zulip Server
Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity ManagementSCIM account management enabled, Zulip Server 5.0 through 5.6 checked the SCIM bearer token using a comparator that did not run in constant time. Therefore, it might theoretically be...
Deep Packet Inspection vs. Metadata Analysis of Network Detection & Response (NDR) Solutions
Today, most Network Detection and Response NDR solutions rely on traffic mirroring and Deep Packet Inspection DPI. Traffic mirroring is typically deployed on a single-core switch to provide a copy of the network traffic to a sensor that uses DPI to thoroughly analyze the payload. While this...
Wipermania: An All You Can Wipe Buffet
Wipermania: An All You Can Wipe Buffet By Max Kersten · November 15, 2022 In early 2022, Ukrainian companies were struck by multiple destructive wipers, attacking various organizations across sectors. This raised questions about the usage and impact of “digital weapons” within the security...
LDAP Active Directory - Group Enumeration
Binary data ldapenumgroup.nbin...
Wipermania: An All You Can Wipe Buffet
Wipermania: An All You Can Wipe Buffet By Trellix · November 15, 2022 This blog was written by Max Kersten In early 2022, Ukrainian companies were struck by multiple destructive wipers, attacking various organizations across sectors. This raised questions about the usage and impact of “digital...
CVE-2022-41917
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries to return a...
LDAP Active Directory - Computer Enumeration
Binary data ldapenumcomputer.nbin...
GSD-2022-1007588 md: Replace snprintf with scnprintf
md: Replace snprintf with scnprintf This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.296 by commit 3b0a2bd51f60418ecd67493586a2bb2174199de3...
GSD-2022-1007282 drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
drm/msm/dpu: index dpukms-hwvbif using vbifidx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.150 by commit...
GSD-2022-1007057 clk: imx: scu: fix memleak on platform_device_add() fails
clk: imx: scu: fix memleak on platformdeviceadd fails This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...
Security Bulletin: Vulnerability from Apache Kafka affect IBM Operations Analytics - Log Analysis (CVE-2021-38153)
Summary Apache Kafka is vulnerable to timing attacks that could allow remote attacker to obtain sensitive information Vulnerability Details CVEID:CVE-2021-38153 DESCRIPTION: Apache Kafka could allow a remote attacker to obtain sensitive information, caused by a timing attack flaw due to the use o...
Trader can still execute the order even after cancelling the order
Lines of code Vulnerability details Impact There are no checks to verify whether the order has been cancelled or not in execute function. This will enable traders to place the order even after cancellation Proof of Concept Execute cancelOrder function with Order data Include the Order in input of...
_returnDust does not revert ether transfer failure
Lines of code Vulnerability details Impact In function returnDust the return value of call is not checked for success. If a user had sent excess ether or if an order in a bulk order had failed, and if the call fails ether will remain in the contract. Users who execute orders later will be able to...
The vulnerability of Adobe Dimension’s 3D design software lies in its software, which, due to the use of memory after it is freed during SKP file analysis, allows a hacker to execute arbitrary code.
The vulnerability of Adobe Dimension’s 3D design software relates to the use of memory after it is freed during the analysis of SKP files. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created file...
The vulnerability of Adobe Dimension’s 3D design software lies in its software, which, due to the use of memory after it is freed during SKP file analysis, allows a hacker to execute arbitrary code.
The vulnerability of Adobe Dimension’s 3D design software relates to the use of memory after it is freed during the analysis of SKP files. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created file...
The vulnerability of Adobe Dimension’s 3D design software lies in its software, which, due to the use of memory after it is freed during SKP file analysis, allows a hacker to execute arbitrary code.
The vulnerability of Adobe Dimension’s 3D design software relates to the use of memory after it is freed during the analysis of SKP files. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially created file...
The Hunt for the FTX Thieves Has Begun
Mysterious crooks took hundreds of millions of dollars from FTX just as it collapsed. Crypto-tracing blockchain analysis may provide an answer...
CVE-2022-45194
CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure...
