CISA offers guidance on dealing with information manipulation

Malicious actors use influence operations, like spreading false information, to shape public opinion, undermine trust, amplify division, and create dissension. In response, the Cybersecurity & Infrastructure Security Agency CISA has released CISA Insights: Preparing for and Mitigating Foreign...

CVE-2018-1312

creationtimestamp| type| source ---|---|--- 2022-02-18 16:23:37+00:00| seen| https://t.me/cyberdenteam/354 2022-06-01 15:53:21+00:00| seen| Telegram/oy0dbBE7nfsKRAHLSCKnQ1rQ2k7lu2BiCitRs7pe50X7S8...

Denial of Service (DoS)

Overview @discordjs/opus is a native bindings to libopus. Affected versions of this package are vulnerable to Denial of Service DoS when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash. PoC // Zero channels: javascript const OpusEncode...

GHSA-VX57-7F4Q-FPC7 Arbitrary redirects under /new endpoint

Impact In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a...

Iranian state-sponsored APT group MuddyWater targeting organizations via malicious executables

THREAT LEVEL: Red. United States Cyber Command USCYBERCOM has warned of an ongoing cyber attack by Iranian state sponsored actor named as MuddyWater. This APT group is currently targeting Middle Eastern countries and has also targeted European and North American nations. The Iranian-backed...

PT-2022-7486 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to memory corruption by preventing array overflow in the tsc2046 component of the Linux kernel. It occurs because indio dev-num channels includes all physical...

Comment reply notifications sent to incorrect users

Impact When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not had editing access t...

CVE-2021-37864

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

Code injection

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

CVE-2021-37864 Users can view the contents of an archived channel when access is explicitly denied by the system admin

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

CVE-2021-37864 Users can view the contents of an archived channel when access is explicitly denied by the system admin

Mattermost 6.1 and earlier fails to sufficiently validate permissions while viewing archived channels, which allows authenticated users to view contents of archived channels even when this is denied by system administrators by directly accessing the APIs...

PT-2022-10681 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.1 and earlier Description: The issue arises from insufficient permission validation when viewing archived channels. This allows authenticated users to bypass system administrator restrictions and view the contents of...

Rocket.Chat: getRoomRoles Method leaks Channel Owner

Summary Lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients. Description Lack of ACL checks in the getRoomRoles Meteor method allow unauthorized clients to query channel members with special roles: javascript Meteor.methods...

Kalkitech Sync Products 加密问题漏洞

Kalkitech Sync Products is a range of substation gateways from Kalkitech India. Kalkitech Sync Products suffers from an encryption issue vulnerability that stems from the use of an insecure communication channel by the management tools Easyconnect and SYNC devices, which can be exploited by an...

GSD-2021-1002684 xen/blkfront: harden blkfront against event channel storms

xen/blkfront: harden blkfront against event channel storms This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.168 by commit...

CVE-2021-30990

creationtimestamp| type| source ---|---|--- 2021-12-16 06:45:25+00:00| published-proof-of-concept| https://t.me/BlueRedTeam/1486 2021-12-16 12:39:02+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/4985...

DEBIAN-CVE-2021-43518

Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate mChannels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code...

UBUNTU-CVE-2021-43518

Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate mChannels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code...

14 New XS-Leaks (Cross-Site Leaks) Attacks Affect All Modern Web Browsers

Researchers have discovered 14 new types of cross-site data leakage attacks against a number of modern web browsers, including Tor Browser, Mozilla Firefox, Google Chrome, Microsoft Edge, Apple Safari, and Opera, among others. Collectively known as "XS-Leaks," the browser bugs enable a malicious...

Auerswald COMpact 8.0B Backdoors

Advisory: Auerswald COMpact Multiple Backdoors RedTeam Pentesting discovered several backdoors in the firmware for the Auerswald COMpact 5500R PBX. These backdoors allow attackers who are able to access the web-based management application full administrative access to the device. Details =======...