Oracle Linux 7 : istio (ELSA-2023-12357)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12357 advisory. - CVE-2022-27496 - CVE-2022-27488 - CVE-2022-27493 - CVE-2022-27492 - CVE-2022-27491 - CVE-2022-27487 Tenable has extracted the preceding description...

CVE-2023-2002

A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hcisock.c in the Linux Kernel. This flaw allows an attacker to unauthorized execution of management commands, compromising the confidentiality, integrity, and availability of Bluetooth...

New PowerExchange Backdoor Used in Iranian Cyber Attack on UAE Government

An unnamed government entity associated with the United Arab Emirates U.A.E. was targeted by a likely Iranian threat actor to breach the victim's Microsoft Exchange Server with a "simple yet effective" backdoor dubbed PowerExchange. According to a new report from Fortinet FortiGuard Labs, the...

Malicious code in test-op-solhint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f8f315fe20128ae26be541522255c4eeab47ec166f70e54ca5a2c6cb533ae67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle AiTM.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2023-2885

CVE-2023-2885 affects CBOT Chatbot: improper enforcement of message integrity during transmission in a non-endpoint channel, enabling adversary-in-the-middle (AiTM) attacks. Affected: Core before v4.0.3.4 and Panel before v4.0.3.7. Exploitation status not stated in the provided docs. Remediation:...

CVE-2023-2885 Channel Accessible by Non-Endpoint in CBOT's Chatbot

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle AiTM. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

MAL-2023-1193 Malicious code in grpc-web-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd95e8ffd2ce1c0ead89d2a5e832f9907583b1642bf8a0df83ca3ed78a09752d The OpenSSF Package Analysis project identified 'grpc-web-devtools' @ 0.1.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1261 Malicious code in pack-123-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 147b1fbc2985e829ebc40869208b16815788e67b83a8670679e6399dd6515755 The OpenSSF Package Analysis project identified 'pack-123-new' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1265 Malicious code in payouts-sdk-samples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3db91ea244189b9afd98f67f2aa7ce4dd00812c2ab83bba670a7f9d285cf167 The OpenSSF Package Analysis project identified 'payouts-sdk-samples' @ 99.20.20 npm as malicious. It is considered malicious because: - The...

CVE-2023-33983

The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-the-middle attacks against later private communication between two introduced parties...

MAL-2023-1256 Malicious code in obao-digital-pnm-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2851227329c005fd686d849285f05ca10150bec82a22a0281a74c4cf091f3d8b The OpenSSF Package Analysis project identified 'obao-digital-pnm-ui' @ 2.0.0 npm as malicious. It is considered malicious because: - The packag...

Malicious code in obao-digital-pnm-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2851227329c005fd686d849285f05ca10150bec82a22a0281a74c4cf091f3d8b The OpenSSF Package Analysis project identified 'obao-digital-pnm-ui' @ 2.0.0 npm as malicious. It is considered malicious because: - The packag...

CVE-2023-25946

Authentication bypass vulnerability in Qrio Lock Q-SL2 firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions...

Authentication flaw

Authentication bypass vulnerability in Qrio Lock Q-SL2 firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions...

CVE-2023-25946

Authentication bypass vulnerability in Qrio Lock Q-SL2 firmware version 2.0.9 and earlier allows a network-adjacent attacker to analyze the product's communication data and conduct an arbitrary operation under certain conditions...

CVE-2023-32348

Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network VPN hub feature for cross-device communication that uses OpenVPN. It connects new devices in a manner that allows the new device to communicate with all Teltonika devices connected to the VPN. The...

Cross site scripting

Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network VPN hub feature for cross-device communication that uses OpenVPN. It connects new devices in a manner that allows the new device to communicate with all Teltonika devices connected to the VPN. The...

CVE-2023-32347

Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker obtained the serial number and MAC address of a device, th...

CVE-2023-32347

Teltonika’s Remote Management System versions prior to 4.10.0 use device serial numbers and MAC addresses to identify devices from the user perspective for device claiming and from the device perspective for authentication. If an attacker obtained the serial number and MAC address of a device, th...