Exploit for Out-of-bounds Write in Google Chrome

From: https://github.com/github/securitylab/tree/main/SecurityEx...

KLA63619 PE vulnerability in Microsoft Browser

An elevation of privilege vulnerability was found in Microsoft Browser. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2024-21388 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Edge CVE list CVE-2024-21388 high KB...

WordPress 6.0 < 6.4.3

WordPress versions 6.0 6.4.3 are affected by one or more vulnerabilities %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from WordPress Security Advisory wordpress-6-4-3-maintenance-and-security-release. include'compat.inc'; if description...

Fedora 39 : dnsmasq (2024-b359bbdf87)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b359bbdf87 advisory. Change initial configuration to use local-service=host for initial listening on localhost. It auto- disables itself as soon as other explicit interface or...

Introducing the Wallarm 2024 API ThreatStatsTM Report

The Wallarm Security Research team is pleased to share the latest version of our API ThreatStats report. This report serves as a key resource for API, Application security practitioners. It emphasizes the need for a proactive stance in API security, advocating for continuous monitoring, regular...

PT-2024-11007 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel versions 8.x Description: The issue is related to an Access Control problem. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...

Fedora 38 : vorbis-tools (2024-5f8da7c1f1)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5f8da7c1f1 advisory. Security fix for CVE-2023-43361 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

AI likely to boost ransomware, warns government body

The British National Cyber Security Centre NCSC says it expects Artificial Intelligence AI to heighten the global ransomware threat. In a report, the NCSC makes the assessment that AI will almost certainly increase the volume and heighten the impact of cyberattacks over the next two years. We’re...

New CherryLoader Malware Mimics CherryTree to Deploy PrivEsc Exploits

A new Go-based malware loader called CherryLoader has been discovered by threat hunters in the wild to deliver additional payloads onto compromised hosts for follow-on exploitation. Arctic Wolf Labs, which discovered the new attack tool in two recent intrusions, said the loader's icon and name...

SystemK NVR 504/508/516

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : SystemK Equipment : NVR 504/508/516 Vulnerability : Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker...

RHCOS 4 / 9 : OpenShift Container Platform 4.14.0 (RHSA-2023:5009)

The remote Red Hat Enterprise Linux CoreOS 4 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5009 advisory. - golang: net/http: handle server errors after sending GOAWAY CVE-2022-27664 - kube-apiserver: Bypassing policies imposed by the...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on January 23, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-023-01 APsystems Energy Communication Unit ECU-C Power Control Software ICSA-24-023-02...

Axis Communications Multiple IP Cameras Command Injection (CVE-2018-10660)

An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver

In this blog, we detail our investigation of the Kasseika ransomware and the indicators we found suggesting that the actors behind it have acquired access to the source code of the notorious BlackMatter ransomware...

Axis Communications Multiple IP Cameras Buffer Overflow (CVE-2018-10664)

An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

Metabase RCE (CVE-2023-38646)

The version of Metabase installed on the remote host is 0.46.x 0.46.6.1, 0.45.x 0.45.4.1, 1.45.x 1.45.4.1, 0.44.x 0.44.7.1, 1.44.x 1.44.7.1, 0.43.x 0.43.7.2, and 1.43.x 1.43.7.2. It is, therefore, affected by a command execution vulnerability when a malicious attacker sends a specially crafted...

VulnCheck KEV: CVE-2020-8115

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver = 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older...

CISA Issues Emergency Directive to Federal Agencies on Ivanti Zero-Day Exploits

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday issued an emergency directive urging Federal Civilian Executive Branch FCEB agencies to implement mitigations against two actively exploited zero-day flaws in Ivanti Connect Secure ICS and Ivanti Policy Secure IPS products...

Fedora 39 : sos (2024-a2129a4eb5)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a2129a4eb5 advisory. Rebase on upstream 4.6.1: see https://github.com/sosreport/sos/releases/tag/4.6.1 for full changelog. Tenable has extracted the preceding description block...

Malware Exploits 9Hits, Turns Docker Servers into Traffic Boosted Crypto Miners

By Deeba Ahmed 9Hits, Double Hit: Malware Mimics Web Tool to Mine Crypto, Generate Fake Website Traffic. This is a post from HackRead.com Read the original post: Malware Exploits 9Hits, Turns Docker Servers into Traffic Boosted Crypto Miners...