Exploit for Improper Authentication in Microsoft

I. Project Objectives and References The purpose is simple: r...

Russian Operator of BTC-e Crypto Exchange Pleads Guilty to Money Laundering

A Russian operator of a now-dismantled BTC-e cryptocurrency exchange has pleaded guilty to money laundering charges from 2011 to 2017. Alexander Vinnik, 44, was charged in January 2017 and taken into custody in Greece in July 2017. He was subsequently extradited to the U.S. in August 2022. Vinnik...

China-Linked Hackers Suspected in ArcaneDoor Cyberattacks Targeting Network Devices

The recently uncovered cyber espionage campaign targeting perimeter network devices from several vendors, including Cisco, may have been the work of China-linked actors, according to new findings from attack surface management firm Censys. Dubbed ArcaneDoor, the activity is said to have commenced...

PT-2024-13102 · Qualcomm · Qualcomm Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to a transient Denial of Service DOS that occurs when processing IKEv2 Informational request messages and a malformed fragment packet is received. This can...

Oracle Linux 9 : runc (ELSA-2024-2180)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2024-2180 advisory. 4:1.1.12-2 - Switch dependency on criu to Recommends - Resolves: RHEL-25116 Tenable has extracted the preceding description block directly from the...

VulnCheck KEV: CVE-2022-24463

Microsoft Exchange Server Spoofing Vulnerability...

Oracle Linux 9 : skopeo (ELSA-2024-2239)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2239 advisory. - rebuild for following CVEs: CVE-2022-41724 CVE-2022-41725 CVE-2023-24537 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539...

DEBIAN-CVE-2023-40475

GStreamer MXF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary dependi...

Meinberg LANTIME Arbitrary File Read (CVE-2018-10835)

Admin users were able to exchange web interface data through the data upload mechanism to which only root users have access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Bitcoin Forensic Analysis Uncovers Money Laundering Clusters and Criminal Proceeds

A forensic analysis of a graph dataset containing transactions on the Bitcoin blockchain has revealed clusters associated with illicit activity and money laundering, including detecting criminal proceeds sent to a crypto exchange and previously unknown wallets belonging to a Russian darknet marke...

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...

gstreamer-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with uncompressed video

A heap-buffer overflow flaw was found in the MXF file demuxer in the GStreamer Plugins Bad when handling malformed files with an uncompressed video. This issue requires user interaction with the library, and could allow a malicious user to cause an integer overflow before allocating the buffer,...

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...

golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.

A flaw was found in the Golang crypto/tls standard library. In previous versions, the package was vulnerable to a Timing Side Channel attack by observing the time it took for RSA-based TLS key exchanges, which was not constant. This flaw allows a malicious user to gather information from the...

kernel: PCI/DOE: Fix destroy_work_on_stack() race

A race condition flaw was found in the Linux kernel's PCI Data Object Exchange DOE implementation. The destroyworkonstack function is called after signaling completion, creating a race where the work struct can go out of scope before being destroyed. This triggers debug object warnings when...

kernel: Kernel: Denial of Service due to memory leak in PCI/DOE

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a memory leak vulnerability in the PCI-e Data Object Exchange PCI/DOE subsystem. This occurs when a PCI/DOE task completes, but its associated work structure is not properly destroyed, leading to a continuous...

BMC software fails to validate IPMI session.

Overview The Intelligent Platform Management Interface IPMI implementations in multiple manufacturer's Baseboard Management Controller BMC software are vulnerable to IPMI session hijacking. An attacker with access to the BMC network with IPMI enabled can abuse the lack of session integrity to...

Dexalot Announces Launch of Its Central Limit Order Book DEX on Arbitrum

By Owais Sultan Central limit order book CLOB decentralized exchange Dexalot has announced it is launching on Arbitrum. The move marks… This is a post from HackRead.com Read the original post: Dexalot Announces Launch of Its Central Limit Order Book DEX on Arbitrum...

PT-2024-7262 · Microsoft +1 · Exchange Server +1

Name of the Vulnerable Software and Affected Versions: 1C-Bitrix Bitrix24 version 23.300.100 Description: The issue is related to insufficiently protected credentials in DAV server settings, allowing remote administrators to read Exchange account passwords via an HTTP GET request. This can permit...

Oracle Linux 9 : gnutls (ELSA-2024-12336)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12336 advisory. 3.7.6-23.4fips - Add FIPS package change: add fips suffix to Release and set Epoch to 10 Orabug: 35925409 - Update FIPS module name for Oracle Linux...