SUSE CVE-2022-42318

Xenstore: guests can let run xenstored out of memory This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service...

Description of the security update for Microsoft Exchange Server 2019, 2016, and 2013: February 14, 2023 (KB5023038)

None None...

CVE-2023-24804

creationtimestamp| type| source ---|---|--- 2023-02-13 20:30:02+00:00| seen| https://t.me/cibsecurity/58015 2023-02-14 09:13:20+00:00| seen| Telegram/yNx8xcOMzym-uwmk69v7zW6sw7sXyn5gg1t71GI9dnHTf28 2023-02-17 00:09:16+00:00| seen| https://t.me/androidMalware/1781 2023-02-17 03:23:35+00:00| seen|...

CVE-2023-23948

creationtimestamp| type| source ---|---|--- 2023-02-13 20:30:00+00:00| seen| https://t.me/cibsecurity/58013 2023-02-14 09:13:20+00:00| seen| Telegram/yNx8xcOMzym-uwmk69v7zW6sw7sXyn5gg1t71GI9dnHTf28 2023-02-17 00:09:16+00:00| seen| https://t.me/androidMalware/1781 2023-02-17 03:23:35+00:00| seen|...

PT-2023-34987 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.1.9 Description: A potential security issue exists due to the lack of a return value check for the create hist field function in the trace events hist module. The actual impact and attack plausibility have no...

OESA-2023-1070 tmux security update

is a terminal multiplexer. It lets you switch easily between several programs in one terminal, detach them they keep running in the background and reattach them to a different terminal. Security Fixes: A null pointer dereference issue was discovered in function windowpanesetevent in window.c in...

USN-5824-1: Thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

zeek -- potential DoS vulnerabilities

Tim Wojtulewicz of Corelight reports: A missing field in the SMB FSControl script-land record could cause a heap buffer overflow when receiving packets containing those header types. Receiving a series of packets that start with HTTP/1.0 and then switch to HTTP/0.9 could cause Zeek to spend a lar...

What Old is New Again and What's Old is Me?

Welcome to this weeks edition of the Threat Source newsletter. Whats old is new again and whats old is still old. The fact that we are seeing a comeback of this USB thumb drive nonsense is giving me heartburn, and a headache, and my left eye is twitching … and maybe numbness in my legs? Yes, I am...

CVE-2023-24058

Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservationsave.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler Sep 6, 2022 Feature...

Booked Scheduler 安全漏洞

Booked Scheduler is a powerful scheduling solution program from Booked. A security vulnerability exists in Booked Scheduler version 2.5.5. An attacker exploits the vulnerability to create and schedule events for any other user by modifying the userId value...

LightFTP 竞争条件问题漏洞

LightFTP is a lightweight FTP service. A security vulnerability exists in LightFTP version 2.2 and earlier versions, which stems from two threads relying on the order or timing of the appearance of events when outputting results. An attacker could exploit the vulnerability to achieve path travers...

CVE-2023-0404

The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above,...

CVE-2023-0404 Events Made Easy <= 2.3.16 - Missing Authorization

The Events Made Easy plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions related to AJAX actions in versions up to, and including, 2.3.16. This makes it possible for authenticated attackers, with subscriber-level permissions and above,...

WordPress plugin Events Made Easy 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2023-16245 · WordPress · Events Made Easy

Name of the Vulnerable Software and Affected Versions: Events Made Easy plugin for WordPress versions up to, and including, 2.3.16 Description: The issue is related to authorization bypass due to a missing capability check on several functions related to AJAX actions. This allows authenticated...

Batloader Malware Abuses Legitimate Tools, Uses Obfuscated JavaScript Files in Q4 2022 Attacks

We discuss the Batloader malware campaigns we observed in the last quarter of 2022, including our analysis of Water Minyades-related events This is the intrusion set we track behind the creation of Batloader...

PT-2023-33373 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.226 Description: The issue concerns the removal of used dynamic events, which may lead to security implications. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linu...

PT-2023-33318 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.158 Description: The issue concerns the removal of used dynamic events, which may lead to the freeing of buffers. This could potentially have security implications, although the actual impact and attack...

PT-2023-33245 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 2.6.33 through 5.15.81 Description: The issue concerns the removal of used dynamic events, which may lead to the freeing of buffers. This problem was introduced in version v2.6.33 and is fixed in version v5.15.82...