392 matches found
Security Navigator Research: Some Vulnerabilities Date Back to the Last Millennium
Vulnerability analysis results in Orange Cyberdefenses' Security Navigator show that some vulnerabilities first discovered in 1999 are still found in networks today. This is concerning. Age of VOC findings Our Vulnerability Scans are performed on a recurring basis, which provides us the opportuni...
StrongPity Hackers Distribute Trojanized Telegram App to Target Android Users
The advanced persistent threat APT group known as StrongPity has targeted Android users with a trojanized version of the Telegram app through a fake website that impersonates a video chat service called Shagle. "A copycat website, mimicking the Shagle service, is used to distribute StrongPity's...
Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities
Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-exploitation activities. Mandiant, which discovered the "socially engineered supply chain" attack around mid-July 2022, said the malicious I...
Upgraded Q -> M from #76 [1670347574630]
Judge has assessed an item in Issue 76 as M risk. The relevant finding follows: L02 address.callvalue:x should be used instead of payable.transfer Impact The use of payable.transfer is heavily frowned upon because it can lead to the locking of funds. The transfer call requires that the recipient...
CVE-2022-45046
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Unifying Threat Findings to Elevate Your Runtime Cloud Security
The widespread growth in cloud adoption in recent years has given businesses across all industries the ability to transform and scale in ways never before possible. However, the speed of those changes, combined with the drastically increased volume and complexity of resources in cloud environment...
Redacted Documents Are Not as Secure as You Think
Popular redaction tools don’t always work as promised, and new attacks can reveal hidden information, researchers say...
Upgraded Q -> M from 272 [1662178113276]
Judge has assessed an item in Issue 272 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Malicious Package
Overview opentelemerty-node-client is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious Package
Overview releasebuildr is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
CVE-2022-33016
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
The Mozilla Foundation Security Advisory describes this flaw as: The Mozilla Fuzzing Team reporting potential vulnerabilities present in Firefox 101 and Firefox ESR 91.10. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have bee...
Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
The Mozilla Foundation Security Advisory describes this flaw as: The Mozilla Fuzzing Team reporting potential vulnerabilities present in Firefox 101 and Firefox ESR 91.10. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have bee...
Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11
The Mozilla Foundation Security Advisory describes this flaw as: The Mozilla Fuzzing Team reporting potential vulnerabilities present in Firefox 101 and Firefox ESR 91.10. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of these could have bee...
Malicious Package
Overview vazgarules is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Malicious Package
Overview separatecalculatingbinary is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious Package
Overview influxdb-client-examples is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...
Malicious Package
Overview holvipartners is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Defending Against Scheduled Task Attacks in Windows Environments
Scheduling tasks is one of the most popular attack techniques used by threat actors to establish persistence on a victim’s machine. The Qualys Research Team investigated different ways that attackers could use to conceal scheduled tasks. In this blog, we describe three new techniques to hide and...