Important: Red Hat Security Advisory: Red Hat Virtualization security and bug fix update

An update is now available for Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, and Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

From Cryptojacking to DDoS Attacks: Diicot Expands Tactics with Cayosin Botnet

Cybersecurity researchers have discovered previously undocumented payloads associated with a Romanian threat actor named Diicot , revealing its potential for launching distributed denial-of-service DDoS attacks. "The Diicot name is significant, as it's also the name of the Romanian organized crim...

Amazon Linux 2023 : runc (ALAS2023-2023-208)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-208 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes /sys/fs/cgroup writable in following...

Improper Certificate Validation

libcurl.so is vulnerable to Improper Certificate Validation. In place of a library's built-in name matching function, Curl may utilize its own name matching function for TLS. IDN hosts could be mismatched by this private wildcard matching function since they are rendered in a weak form before...

Malicious code in legal-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 889df12ead796af3e20b965b76b67dd029c687100599b2435933f0c7e82e8f53 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Evasive QBot Malware Leverages Short-lived Residential IPs for Dynamic Attacks

An analysis of the "evasive and tenacious" malware known as QBot has revealed that 25% of its command-and-control C2 servers are merely active for a single day. What's more, 50% of the servers don't remain active for more than a week, indicating the use of an adaptable and dynamic C2...

RomCom RAT Using Deceptive Web of Rogue Software Sites for Covert Attacks

The threat actors behind RomCom RAT are leveraging a network of fake websites advertising rogue versions of popular software at least since July 2022 to infiltrate targets. Cybersecurity firm Trend Micro is tracking the activity cluster under the name Void Rabisu, which is also known as Tropical...

Faronics Insight 访问控制错误漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which originates from the creation of a specially crafted program with functionality similar to the Teacher's Console, which can write arbitrary...

Debian DSA-5413-1 : sniproxy - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5413 advisory. An issue has been found in sniproxy, a transparent TLS and HTTP layer 4 proxy with SNI support. Due to bad handling of wildcard backend hosts, a crafted HTTP or TLS packet...

Exploit for OS Command Injection in Eparks Fiberlink_210_Firmware

CVE-2023-33617 Authenticated OS command injection vulnerabili...

CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

CVE-2023-28321

An improper certificate validation vulnerability exists in curl v8.1.0 in the way it supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS...

Updated sniproxy packages fix security vulnerability

A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy. A specially crafted HTTP or TLS packet can lead to arbitrary code execution. An attacker could send a malicious packet to trigger this vulnerability. CVE-2023-25076...

Metasploit Weekly Wrap-Up

Fetch Based Payloads: Making the Path from Command Injection to Metasploit Session Shorter This week we’re releasing Metasploit fetch payloads. Fetch payloads are command-based payloads that leverage network-enabled applications on remote hosts and different protocol servers to serve, download, a...

Malicious code in conversations-with-friends-by-sally-rooney-on-audible-new-volumes- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43a3c0ad8210a979fccfd7f614cae9493219922b5e13d2a02d9a84a2beda365d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in the-four-tendencies-the-indispensable-personality-profiles-that-reveal-how-to-make-your-life-better- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e9297cd32e9acc254a75e4a5d526916cc24499d026cbc04de40218284ff849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth-test-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb18aabc5749a94ac657ae109997f03bd170e42c876bd450cc0bf43ee32619cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in poker_clock_professional_22_better_crack_h8z6f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d6822ba68ebf81c5841ac4bbc54ee01cb10d686b967ce796f11bd7fb993d79b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdc40_yamatake_manual_gi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9340e2ff538d820e82c4609b9b0033a3222f425183f5c83d6a525a01e93529b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Multiple path traversals on Windows hosts

Description validatepathissafe function in file /mlflow/server/handlers.py, introduced in PR 7891 on Feb 24th, 2023 does not account for Windows absolute path format, and thus can be bypassed on MLFlow servers, running on Windows hosts, exposing them to a number of high-impact directory traversal...