‘Largest Botnet Ever’ Tied to Billions in Stolen Covid-19 Relief Funds

The US says a Chinese national operated the “911 S5” botnet, which included computers worldwide and was used to file hundreds of thousands of fraudulent Covid claims and distribute CSAM, among other crimes...

2024 Cybersecurity Trends: What’s Observable Already?

2024 has already witnessed a staggering number of cyber incidents, with over 29.5 billion records breached across 4,645 publicly disclosed incidents in January alone, according to the IT Governance Security Spotlight. Moreover, CVEs are growing significantly year over year, with 13% growth from...

The Idea of Web3 and 7 Global Web3 Agencies

By Waqas This comprehensive Web3 guide explores its core principles, and real-world applications, and addresses the challenges and opportunities that… This is a post from HackRead.com Read the original post: The Idea of Web3 and 7 Global Web3 Agencies...

The Idea of Web3 and 7 Global Web3 Agencies

By Waqas This comprehensive Web3 guide explores its core principles, and real-world applications, and addresses the challenges and opportunities that… This is a post from HackRead.com Read the original post: The Idea of Web3 and 7 Global Web3 Agencies...

Privacy Implications of Tracking Wireless Access Points

Brian Krebs reports on research into geolocating routers: Apple and the satellite-based broadband service Starlink each recently took steps to address new research into the potential security and privacy implications of how their services geolocate devices. Researchers from the University of...

SUSE CVE-2023-52760

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in gfs2qddealloc In gfs2putsuper, whether withdrawn or not, the quota should be cleaned up by gfs2quotacleanup. Otherwise, struct gfs2sbd will be freed before gfs2qddealloc rcu callback has run for a...

PT-2024-40477 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe Framework affected versions not specified Description: The issue allows arbitrary global functions to be executed if malicious user input is passed through as the second argument of ViewableData::renderWith. This occurs when the...

On the Zero-Day Market

New paper: "Zero Progress on Zero Days: How the Last Ten Years Created the Modern Spyware Market": Abstract: Spyware makes surveillance simple. The last ten years have seen a global market emerge for ready-made software that lets governments surveil their citizens and foreign adversaries alike an...

libssh security update

0.9.6-14 - Fix CVE-2023-48795 Prefix truncation attack on Binary Packet Protocol BPP - Fix CVE-2023-6918 Missing checks for return values for digests - Fix CVE-2023-6004 ProxyCommand/ProxyJump features allow injection of malicious code through hostname - Note: version is bumped from 12 to 14...

Apache Tomcat 8.0.0.RC1 < 8.0.37 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 8.0.37. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat8.5.5and8.0.37security-8 advisory. - The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4,...

PT-2024-27019

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a null pointer dereference in the Linux kernel when configuring 'power' and 'submit queues' concurrently, which can trigger a kernel panic. This occurs because de...

CVE-2021-47335

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid racing on fsyncentryslab by multi filesystem instances As syzbot reported, there is an use-after-free issue during f2fs recovery: Use-after-free write at 0xffff88823bc16040 in kfence-10:...

kernel: cpufreq: amd-pstate: fix global sysfs attribute type

In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: fix global sysfs attribute type In commit 3666062b87ec "cpufreq: amd-pstate: move to use busgetdevroot" the "amdpstate" attributes where moved from a dedicated kobject to the cpu root kobject. While the...

kernel: Linux kernel: RDMA/core GID entry leak causes Denial of Service

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA core component. A local user with low privileges could trigger a Global Identifier GID entry reference leak when an Address Handle AH creation request fails. This resource leak could lead to system instability and a Denial of...

Grandoreiro Trojan: An Evolving Threat to Global Banking

...

DEBIAN-CVE-2023-52871

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: llcc: Handle a second device without data corruption Usually there is only one llcc device. But if there were a second, even a failed probe call would modify the global drvdata pointer. So check if drvdata is valid...

DEBIAN-CVE-2023-52760

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in gfs2qddealloc In gfs2putsuper, whether withdrawn or not, the quota should be cleaned up by gfs2quotacleanup. Otherwise, struct gfs2sbd will be freed before gfs2qddealloc rcu callback has run for a...

CVE-2023-52794

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: powerclamp: fix mismatch in get function for maxidle KASAN reported this 444.853098 BUG: KASAN: global-out-of-bounds in paramgetint+0x77/0x90 444.853111 Read of size 4 at addr ffffffffc16c9220 by task cat/2105...

CVE-2021-47346

In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etf: Fix global-out-of-bounds in tmcupdateetfbuffer commit 6f755e85c332 "coresight: Add helper for inserting synchronization packets" removed trailing '\0' from barrierpkt array and updated the call sites like...

CVE-2021-47346

In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etf: Fix global-out-of-bounds in tmcupdateetfbuffer commit 6f755e85c332 "coresight: Add helper for inserting synchronization packets" removed trailing '\0' from barrierpkt array and updated the call sites like...