VMware Horizon Server updates address multiple security vulnerabilities (CVE-2023-34037, CVE-2023-34038)

3a. Request smuggling vulnerability CVE-2023-34037 VMware Horizon Server contains a HTTP request smuggling vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3. 3b. Information disclosure vulnerability...

PT-2023-4281 · Vmware · Vmware Horizon Server

Name of the Vulnerable Software and Affected Versions: VMware Horizon Server affected versions not specified Description: The issue is related to insufficient protection of service data, which may allow a remote attacker to gain unauthorized access to confidential information. A malicious actor...

MAL-2023-398 Malicious code in fca-horizon-remaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d82aee22fcb9d69dc1b8ec8823954165ce545b1ab39eebd6f330094e1b84af84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-40 Malicious code in @leesiwoo/fca-horizon-remake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8dec25cc111a5b3b0146bc3b1436ce0a77fed1c784460a1be82ace48ed2ab4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-399 Malicious code in fca-horizon-remastered (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22e4b2051f69220a9caa031f9973e92468b01c05b2c9688ea2aa5e0931e8467e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-horizon-remastered (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22e4b2051f69220a9caa031f9973e92468b01c05b2c9688ea2aa5e0931e8467e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OpenNMS Horizon Authenticated RCE

This module exploits built-in functionality in OpenNMS Horizon in order to execute arbitrary commands as the opennms user. For versions 32.0.2 and higher, this module requires valid credentials for a user with ROLEFILESYSTEMEDITOR privileges and either ROLEADMIN or ROLEREST. For versions 32.0.1 a...

North Korean Hacker Group Andariel Strikes with New EarlyRat Malware

The North Korea-aligned threat actor known as Andariel leveraged a previously undocumented malware called EarlyRat in phishing attacks, adding another piece to the group's wide-ranging toolset. "Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from...

Oracle Linux 9 : fwupd (ELSA-2023-2487)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2487 advisory. 1.8.10-2.0.1 - Drop pesign.service restart in postun Orabug: 34760075 - Update signing certificate JIRA: OLDIS-16371 - Rebuild for SecureBoot signature...

SUSE CVE-2023-0870

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer...

OpenNMS Horizon 安全漏洞

OpenNMS Horizon is an open source solution from OpenNMS, Inc. that helps you visualize and monitor everything on your local and remote networks. A security vulnerability exists in OpenNMS Horizon that stems from the fact that the Horizon REST API includes an endpoint named users that is vulnerabl...

OpenNMS Meridian and Horizon vulnerable to Cross-Site Request Forgery

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer...

Cross site request forgery (csrf)

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer...

CVE-2023-0870 Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer...

CVE-2023-0870 Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer...

CVE-2023-0870 Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer...

OpenNMS Horizon 代码问题漏洞

OpenNMS Horizon is an open source solution from OpenNMS, Inc. that helps you visualize and monitor everything on your local and remote networks. A security vulnerability exists in OpenNMS Horizon version 31.0.8 through versions prior to 32.0.2. An attacker exploited the vulnerability to force...

Opennms Group OpenNMS 跨站请求伪造漏洞

Opennms Group OpenNMS is an open source, enterprise-grade network monitoring and network management platform from the US-based Opennms Group, Inc. A cross-site request forgery vulnerability exists in OpenNMS Meridian, Horizon, which can be exploited by an attacker to access confidential informati...

PT-2023-16574 · Opennms · Opennms Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Meridian versions prior to 2023.1.1 OpenNMS Horizon versions prior to 31.0.6 Description: A form can be manipulated with cross-site request forgery in OpenNMS Meridian and Horizon, potentially allowing an attacker to gain access to...

Authorities Shut Down ChipMixer Platform Tied to Crypto Laundering Scheme

A coalition of law enforcement agencies across Europe and the U.S. announced the takedown of ChipMixer, an unlicensed cryptocurrency mixer that began its operations in August 2017. "The ChipMixer software blocked the blockchain trail of the funds, making it attractive for cybercriminals looking t...