ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions

US Immigration and Customs Enforcement’s one-year contract with Paragon’s US subsidiary comes amid the Biden administration’s years-long crackdown on commercial spyware vendors...

Notorious Evil Corp Hackers Targeted NATO Allies for Russian Intelligence

UK law enforcement and international partners have released new details about the cybercriminal gang Evil Corp, including its use of the Lockbit ransomware platform and ties to Russian intelligence...

CVE-2024-38809

Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions should upgrade to the corresponding fixed version. Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers,...

Telegram will hand over user details to law enforcement

Last month we reported how Telegram CEO Pavel Durov was indicted on charges of complicity in the distribution of child sex abuse images, aiding organized crime, drug trafficking, fraud, and refusing lawful orders to give information to law enforcement. Now, in a potentially related development,...

Europol Shuts Down iServer Phishing Scheme and Ghost Cybercrime Chat Platform

Law enforcement authorities have announced the takedown of an international criminal network that leveraged a phishing platform to unlock stolen or lost mobile phones. The phishing-as-a-service PhaaS platform, called iServer, is estimated to have claimed more than 483,000 victims globally, led by...

Tor anonymity compromised by law enforcement. Is it still safe to use?

Despite people generally considering the Tor network as an essential tool for anonymous browsing, german law enforcement agencies have managed to de-anonymize Tor users after putting surveillance on Tor servers for months. Before we go into the what the agencies did, let's take a look at some...

Global Crime Hit as Europol Shuts Down Encrypted Chat App Ghost

Europol, alongside global law enforcement, dismantled the encrypted chat app Ghost, widely used by criminal networks for drug…...

Improper Authorization

org.opendaylight.mdsal : mdsal-artifacts is vulnerable to Improper Authorization. The vulnerability is due to improper role enforcement, allowing a controller with a follower role to configure flow entries in an OpenDaylight clustering deployment...

CVE-2024-44092

There is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-44092

CVE-2024-44092 describes a missing LCS signing enforcement caused by test/debugging code left in a production build, potentially enabling local privilege escalation without user interaction. Public materials in this set confirm impact on Google Pixel/Android components, with references in the Pix...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google USA. Google Pixel suffers from a security vulnerability that stems from legacy test/debug code in the production version, which may lack LCS signature enforcement, leading to local privilege escalation...

CVE-2024-44092: Active Debug Code

There is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-30943

Name of the Vulnerable Software and Affected Versions TBD affected versions not specified Description The issue is related to a missing LCS signing enforcement due to test/debugging code left in a production build. This could lead to local escalation of privilege with no additional execution...

Singapore Police Arrest Six Hackers Linked to Global Cybercrime Syndicate

The Singapore Police Force SPF has announced the arrest of five Chinese nationals and one Singaporean man for their alleged involvement in illicit cyber activities in the country. The development comes after a group of about 160 law enforcement officials conducted a series of raids on September 9...

We Hunted Hidden Police Signals at the DNC

Using special software, WIRED investigated police surveillance at the DNC. We collected signals from nearly 300,000 devices, revealing vulnerabilities for both law enforcement and everyday citizens alike...

PUB-A-345848543

In TBD of TBD, there is a possible LCS signing enforcement missing due to test/debugging code left in a production build. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-41964

Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's...

CVE-2024-42340

CVE-2024-42340 corresponds to a CyberArk Identity Management issue: client-side enforcement of server-side security. The connected PT-2024-5772 document describes a vulnerability where a remote, unauthenticated attacker can bypass security controls to elevate privileges due to client-side enforce...

CVE-2024-42340: Client-Side Enforcement of Server-Side Security

CyberArk - CWE-602: Client-Side Enforcement of Server-Side Security...

openSUSE 15 Security Update : chromium (openSUSE-SU-2024:0258-2)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0258-2 advisory. - Chromium 128.0.6613.84 boo1229591 CVE-2024-7964: Use after free in Passwords CVE-2024-7965: Inappropriate implementation in V8 CVE-2024-7966: O...