7061 matches found
LockBit 2.0 Ransomware affiliates targeting Renowned Organizations
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Since September 2021, LockBit 2.0 has targeted 500+ organizations in vital areas globally. The most recent attack targeted well-known tire producer Bridgestone, software behemoth Accenture, and the French Ministry of Justice...
Weekly Threat Digest: 7 – 13 March 2022
For a detailed threat digest, download the pdf file here Published Vulnerabilities Interesting Vulnerabilities Active Threat Groups Targeted Countries Targeted Industries ATT&CK TTPs 538 16 3 42 19 89 The second week of March 2022 witnessed the discovery of 538 vulnerabilities out of which 16...
CVE-2022-0847 aka Dirty Pipe vulnerability in Linux kernel
Last week, security researcher Max Kellermann discovered a high severity vulnerability in the Linux kernel, which was assigned the designation CVE-2022-0847. It affects the Linux kernels from 5.8 through any version before 5.16.11, 5.15.25 and 5.10.102, and can be used for local privilege...
ALSA-2022:0845 Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.7.0. Security Fixes: Mozilla: Use-after-free in XSLT parameter processing CVE-2022-26485 Mozilla: Use-after-free in WebGPU IPC Framework CVE-2022-26486 expat: Malformed 2- and 3-byte UTF-...
RHEL 8 : thunderbird (RHSA-2022:0843)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:0843 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 91.7.0. Security Fixes: Mozilla:...
Design/Logic Flaw
Under certain conditions, SAP NetWeaver Real Time Messaging Framework - version 7.50, allows an attacker to access information which could lead to information gathering for further exploits and attacks...
CVE-2022-22547
Simple Diagnostics Agent - versions 1.0 up to version 1.57., allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits...
Design/Logic Flaw
Simple Diagnostics Agent - versions 1.0 up to version 1.57., allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits...
Mozilla: Use-after-free in XSLT parameter processing
A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as: Removing an XSLT parameter during processing could have led to an exploitable use-after-free issue. There were reports of attacks in the wild abusing this flaw...
CVE-2022-22547
Simple Diagnostics Agent - versions 1.0 up to version 1.57., allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits...
UBUNTU-CVE-2022-26485
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox 97.0.2, Firefox ESR 91.6.1, Firefox for Android 97.3.0, Thunderbird 91.6.2, and Focus 97.3.0...
KLA12470 Multiple vulnerabilities in Mozilla Firefox
Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in XSLT parameter processing can be exploited to cause denial ...
SUSE-SU-2022:0559-1 Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 91.6.1 / MFSA 2022-07 bsc1196072 CVE-2022-0566 bmo1753094 Crafted email could trigger an out-of-bounds write - Mozilla Thunderbird 91.6 / MFSA 2022-06 bsc1195682 CVE-2022-22753 bmo1732435 Privilege Escalation to...
Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool
Researchers from China's Pangu Lab have disclosed details of a "top-tier" backdoor put to use by the Equation Group, an advanced persistent threat APT with alleged ties to the cyber-warfare intelligence-gathering unit of the U.S. National Security Agency NSA. Dubbed "Bvp47" owing to numerous...
A week in security (February 14 – February 20)
Last week on Malwarebytes Labs: Adobe patches actively exploited Magento/Adobe Commerce zero-day Ransomware gang hits 49ers’ network before Super Bowl kick off Don’t let scammers ruin your Valentine’s Day CISA Ransomware report warns “triple threat” attacks still on the prowl City: Skylines...
SUSE SLES15 Security Update : json-c (SUSE-SU-2022:0184-2)
The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:0184-2 advisory. - CVE-2020-12762: Fixed integer overflow and out-of-bounds write. bsc1171479 Tenable has extracted the preceding description block directly from the SU...
Log4Shell 2 Months Later: Security Strategies for the Internet's New Normal
CVE-2021-44228 rules everything around us — or so it seemed, at least, for those breathless days in December 2021 when the full scope of Log4Shell was starting to take hold and security teams were strapped for time and resources as they scoured their organizations' environments for vulnerable...
CVE-2022-23190 Adobe Illustrator Out-of-bounds Read could lead to Memory leak
Adobe Illustrator versions 25.4.3 and earlier and 26.0.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user...
Google Releases Security Updates for Chrome
Google has released Chrome version 98.0.4758.102 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. One of these vulnerabilities has been detected in exploits in the wild. CISA encourages users and administrato...