Mallox Ransomware A Resurgent Threat Exploiting MS-SQL Flaws

Summary: Mallox is a resilient Ransomware-as-a-Service RaaS threat, utilizing tactics like exploiting MS-SQL vulnerabilities and employing brute force attacks. Operating with a prolonged presence, Malloxs recent variant, "Mallox.Resurrection," exhibits consistent functionalities, emphasizing the...

KLA73522 SB vulnerability in WinSCP

Security bypass vulnerability was found in WinSCP. Malicious users can remotely exploit this vulnerability to bypass security restrictions. Original advisories Changes in WinSCP 6.2.2 Exploitation Public exploits exist for this vulnerability. Related products WinSCP CVE list CVE-2023-48795 high...

GLSA-202312-08 : LibRaw: Heap Buffer Overflow

The remote host is affected by the vulnerability described in GLSA-202312-08 LibRaw: Heap Buffer Overflow - A flaw was found in LibRaw. A heap-buffer-overflow in raw2imageex caused by a maliciously crafted file may lead to an application crash. CVE-2023-1729 Note that Nessus has not tested for th...

KLA62621 Multiple vulnerabilities in OpenOffice

Multiple vulnerabilities were found in OpenOffice. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability can be exploited to cause denial of service. 2. Remote code...

How Outlook notification sounds can lead to zero-click exploits

An Akamai researcher has found two vulnerabilities in Windows that can be combined to achieve a full, zero-click remote code execution RCE in Outlook. Both vulnerabilities were responsibly disclosed to Microsoft and addressed in the August 2023 and October 2023 patch Tuesdays, so the researcher...

Experts Detail Multi-Million Dollar Licensing Model of Predator Spyware

A new analysis of the sophisticated commercial spyware called Predator has revealed that its ability to persist between reboots is offered as an "add-on feature" and that it depends on the licensing options opted by a customer. "In 2021, Predator spyware couldn't survive a reboot on the infected...

Windows CLFS and five exploits used by ransomware operators (Exploit #2 – September 2022)

This is the third part of our study about the Common Log File System CLFS and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you havent already. You can skip to the other parts using this tab...

Windows CLFS and five exploits used by ransomware operators

In April 2023, we published a blog post about a zero-day exploit we discovered in ransomware attacks that was patched as CVE-2023-28252 after we promptly reported it to Microsoft. In that blog post, we mentioned that the zero-day exploit we discovered was very similar to other Microsoft Windows...

Windows CLFS and five exploits used by ransomware operators (Exploit #5 – CVE-2023-28252)

This is part six of our study about the Common Log File System CLFS and five vulnerabilities in this Windows OS component that have been used in ransomware attacks throughout the year. Please read the previous parts first if you havent already. You can go to other parts using this table of...

QNAP VioStor NVR

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available/known public exploitation Vendor : QNAP Equipment : VioStor NVR Vulnerability : OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability...

Fedora 39 : chromium (2023-1de2fe25c4)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1de2fe25c4 advisory. update to 120.0.6099.129 - High CVE-2023-7024: Heap buffer overflow in WebRTC Tenable has extracted the preceding description block directly from the Fedora...

KLA62549 DoS vulnerability in Microsoft Browser

Heap buffer overflow vulnerability was found in Microsoft Browser. Malicious users can exploit this vulnerability to cause denial of service. Original advisories CVE-2023-7024 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Edge CVE list CVE-2023-7024 critica...

Google Chrome < 120.0.6099.129 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 120.0.6099.129. It is, therefore, affected by a vulnerability as referenced in the 202312stable-channel-update-for-desktop20 advisory. - Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a...

KLA62539 DoS vulnerability in Google Chrome

Heap buffer overflow vulnerability was found in Google Chrome. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Chrome Releases: Stable Channel Update for Desktop Exploitation Public exploits exist for this vulnerability. Related products Google-Chrom...

EuroTel ETL3100 Radio Transmitter

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : EuroTel Equipment : ETL3100 Vulnerabilities : Improper Restriction of Excessive Authentication Attempts, Authorization Bypass Through User-Controlled Key,...

Beware: Experts Reveal New Details on Zero-Click Outlook RCE Exploits

Technical details have emerged about two now-patched security flaws in Microsoft Windows that could be chained by threat actors to achieve remote code execution on the Outlook email service sans any user interaction. "An attacker on the internet can chain the vulnerabilities together to create a...

SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2023:4827-1)

The remote SUSE Linux SLED12 / SLEDSAP12 / SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4827-1 advisory. - An out-of-bounds read was addressed with improved input validation. CVE-2023-42916 - A memory corruption...

RHEL 9 : Red Hat Single Sign-On 7.6.6 security update on RHEL 9 (Important) (RHSA-2023:7855)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7855 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

Peeking into the crystal ball: What 2023 cyber threats told us about 2024

By Raj Samani, SVP Chief Scientist, and Sabeen Malik, Vice President, Global Government Affairs and Public Policy at Rapid7 Stepping into 2024 feels like opening the latest best-selling mystery novel – you know there's adventure ahead, but the plot is still up in the air. In the twist-riddled wor...

KLA62388 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service, overwrite arbitrary files, gain privileges, spoof user interface. Below is a complete list of...