Exploit for Improper Access Control in Samsung Livewallpaperservice

Improper access control vulnerability in LiveWallpaperService...

Experts Analyze Conti and Hive Ransomware Gangs' Chats With Their Victims

An analysis of four months of chat logs spanning more than 40 conversations between the operators of Conti and Hive ransomware and their victims has offered an insight into the groups' inner workings and their negotiation techniques. In one exchange, the Conti Team is said to have significantly...

Protect

An improper certificate validation vulnerability CWE-295 in FortiOS may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the FortiGate and some peers such as private SDNs and external cloud platforms...

Warning! Instagram Stories hides a scam in plain sight

When someone finds their social media account compromised, they first think about letting their followers know. And they do. They warn others from reading any strange posts, usually containing a rogue link, before they sort out the matter behind the scenes. Some curious followers who missed these...

Mitsubishi Electric FA Products Authentication Bypass By Capture-Replay (CVE-2022-25159)

Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5UC CPU all versions and Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions allows a remote unauthenticated attacker to login to the product by replay attack. This plugin only works with...

Mitsubishi Electric FA Products Use of Weak Hash (CVE-2022-25156)

Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5UC CPU all versions and Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all versions allows a remote unauthenticated attacker to login to the product by using a password reversed from a previously eavesdropped password...

CVE-2022-22275

Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service DoS attack if a target host is vulnerable...

CVE-2022-22275

Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting in Denial of Service DoS attack if a target host is vulnerable...

CVE-2022-22275

CVE-2022-22275 pertains to SonicOS (SonicWall firewall) and describes an improper restriction of the TCP communication channel for HTTP/S inbound traffic from WAN to DMZ, potentially enabling a DoS attack until the TCP handshake completes. Connected sources (SonicWall PSIRT SNWLID-2022-0004) conf...

kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS

A stack overflow flaw was found in the Linux kernel’s TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges...

CVE-2022-24792

PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length...

Design/Logic Flaw

PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects applications on a 32-bit systems that use PJSIP versions 2.12 and prior to play/read invalid WAV files. The vulnerability occurs when reading WAV file data chunks with length...

CVE-2021-36460

VeryFitPro com.veryfit2hr.second 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's...

Hyperledger: Unauthorized packages modification or secrets exfiltration via GitHub actions

Thank you to @dustywormwood for working closely with the Iroha team to fix this issue. You can learn more about this vulnerability type at https://github.com/nikitastupin/pwnhub. Thanks to the Hyperledger team for thorough remediation and clear communication!...

Spock SLAF - A Shared Library Application Firewall "SLAF"

Spock SLAF is a Shared Library Application Firewall "SLAF". It has the purpose to protect any service that uses the OpenSSL library. The SLAF inserts hooking to intercept all communication to detect security anomalies and block and log attacks like buffer overflow, path traversal, XXE and SQL...

CVE-2021-3898

Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...

CVE-2021-3898

Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...

CVE-2021-3898

The CVE-2021-3898 issue affects Motorola Ready For and Motorola Device Help Android apps prior to 2021-04-08, caused by improper verification of server certificates. The root cause enables an attacker to access the communication channel. Reported impacts include potential confidentiality exposure...

CVE-2021-3898

Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...

Motorola Ready For 信任管理问题漏洞

Motorola Ready For is a feature from Motorola USA. It enhances the functionality of a cell phone by connecting it to any display or monitor1,2. A security vulnerability exists in Motorola Ready For that stems from the application's inability to properly validate server certificates. An attacker...