The sound of you typing on your keyboard could reveal your password

As if password authentications coffin needed any more nails, researchers in the UK have discovered yet another way to hammer one in. The technique, developed at Durham University, the University of Surrey, and Royal Holloway University of London, builds on previous work to produce a more accurate...

SpyLoan Scandal: 18 Malicious Loan Apps Defraud Millions of Android Users

Cybersecurity researchers have discovered 18 malicious loan apps for Android on the Google Play Store that have been collectively downloaded over 12 million times. "Despite their attractive appearance, these services are in fact designed to defraud users by offering them high-interest-rate loans...

PT-2023-32671 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns a failure to validate route parameters in the Mattermost webapp, specifically in the //channels/ path, allowing an attacker to perform a client-side path traversal...

DEBIAN-CVE-2023-45287

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...

Design/Logic Flaw

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...

GO-2023-2375 Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...

The vulnerability in the implementation of Secure Connections Pairing and Secure Simple Pairing according to the Bluetooth Core Specification allows a attacker to carry out a “man-in-the-middle” attack.

The vulnerability of the Secure Connections Pairing and Secure Simple Pairing implementations in the Bluetooth Core Specification relates to the retrieval of session keys upon accessing a channel from a non-endpoint. Exploiting this vulnerability could allow an attacker to carry out a...

Mattermost Security Bypass Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security bypass vulnerability exists in Mattermost that stems from an inability to check if the "Allow users to view archived channels" setting is enabled during the permalink preview display, even i...

Information Disclosure

Mattermost is vulnerable to Information Disclosure. The vulnerability is due to a failure to check whether the Allow users to view archived channels setting is enabled during permalink previews display. This flaw allows members to view permalink previews of archived channels, even if the Allow...

GHSA-JJR7-372R-CX7X Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Mattermost fails to check whether the "Allow users to view archived channels" setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the "Allow users to view archived channels" setting is disabled...

Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability

Mattermost fails to check whether the "Allow users to view archived channels" setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the "Allow users to view archived channels" setting is disabled...

Code injection

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled...

CVE-2023-43754 Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled...

CVE-2023-43754 Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled...

PT-2023-28966 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to check if the "Allow users to view archived channels" setting is enabled when displaying permalink previews. This oversight allows members to...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost Inc. in the United States. A security vulnerability exists in Mattermost that stems from an inability to check whether the "Allow users to view archived channels" setting is enabled during permalink preview display, allowing...

Russian Cyber Espionage Group Deploys LitterDrifter USB Worm in Targeted Attacks

Russian cyber espionage actors affiliated with the Federal Security Service FSB have been observed using a USB propagating worm called LitterDrifter in attacks targeting Ukrainian entities. Check Point, which detailed Gamaredon's aka Aqua Blizzard, Iron Tilden, Primitive Bear, Shuckworm, and...

kernel: Linux kernel: ALSA HDA denial of service via array overflow

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA High Definition Audio HDA component. A local user could exploit this vulnerability by providing specially crafted 9.1 surround channel names, leading to an array overflow in the getlineoutpfx function. This can cause a...

CVE-2021-43609

creationtimestamp| type| source ---|---|--- 2023-11-11 07:33:59+00:00| published-proof-of-concept| https://t.me/CNArsenal/1486 2023-11-11 20:38:04+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9370 2023-11-24 04:36:04+00:00| seen| https://t.me/kasraonecom/601 2024-08-1...

kernel: Linux kernel: ALSA HDA denial of service via array overflow

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA High Definition Audio HDA component. A local user could exploit this vulnerability by providing specially crafted 9.1 surround channel names, leading to an array overflow in the getlineoutpfx function. This can cause a...