Bruce Schneier predicts a future of AI-powered mass spying: Lock and Code S05E03

This week on the Lock and Code podcast… If the internet helped create the era of mass surveillance, then artificial intelligence will bring about an era of mass spying. That’s the latest prediction from noted cryptographer and computer security professional Bruce Schneier, who, in December, share...

CVE-2023-48132

An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token...

CVE-2024-22551

WhatACart v2.0.7 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /site/default/search...

CVE-2024-22636

creationtimestamp| type| source ---|---|--- 2024-01-25 22:26:25+00:00| seen| https://t.me/ctinow/173838 2024-02-18 17:41:55+00:00| seen| https://t.me/ctinow/187316...

The Unknown Risks of The Software Supply Chain: A Deep-Dive

In a world where more & more organizations are adopting open-source components as foundational blocks in their application's infrastructure, it's difficult to consider traditional SCAs as complete protection mechanisms against open-source threats. Using open-source libraries saves tons of coding...

BELL-CVE-2023-51042

Bulletin has no description...

CVE-2024-0812

Inappropriate implementation in Accessibility in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-23209

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content may lead to arbitrary code execution...

CVE-2024-23342 python-ecdsa vulnerable to Minerva attack on P-256

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

CVE-2024-0725 ProSSHD denial of service

A vulnerability was found in ProSSHD 1.2 on Windows. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of thi...

PT-2024-12183 · Skoda · Skoda Automotive Cloud

Name of the Vulnerable Software and Affected Versions: Skoda Automotive cloud affected versions not specified Description: The issue allows attackers to obtain nicknames and other user identifiers of Skoda Connect service users by specifying an arbitrary vehicle VIN number, due to a Broken Access...

Skoda Security Breach

Skoda is a line of automobiles from Skoda Inc. A security vulnerability exists in Skoda Automotive that originates from allowing access to user nicknames and identifiers by specifying arbitrary vehicle VIN numbers...

Feds Warn of AndroxGh0st Botnet Targeting AWS, Azure, and Office 365 Credentials

The U.S. Cybersecurity and Infrastructure Security Agency CISA and the Federal Bureau of Investigation FBI warned that threat actors deploying the AndroxGh0st malware are creating a botnet for "victim identification and exploitation in target networks." A Python-based malware, AndroxGh0st was fir...

CVE-2024-20930

...

CVE-2024-20906

...

CVE-2024-0232

creationtimestamp| type| source ---|---|--- 2024-01-16 15:26:32+00:00| seen| https://t.me/ctinow/168849 2024-01-24 17:16:54+00:00| seen| https://t.me/ctinow/172925 2024-01-30 14:41:49+00:00| seen| https://t.me/ctinow/175937 2024-03-15 11:26:41+00:00| seen| https://t.me/ctinow/208636 2024-11-14...

WordPress InstaWP Connect Plugin <= 0.1.0.8 is vulnerable to Privilege Escalation

Software InstaWP Connect Type Plugin Vulnerable versions = 0.1.0.8 Fixed in 0.1.0.9 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-22145 Patch priority High CVSS severity High 8.8 Developer InstaWP PSID f661e38694ec Credits Majed Refae...

CVE-2024-21613 Junos OS and Junos OS Evolved: A link flap causes patroot memory leak which leads to rpd crash

A Missing Release of Memory after Effective Lifetime vulnerability in Routing Protocol Daemon RPD of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause an rpd crash, leading to Denial of Service DoS. On all Junos OS and Junos OS Evolved platforms,...

CVE-2023-50126

Missing encryption in the RFID tags of the Hozard alarm system Alarmsysteem v1.0 allow attackers to create a cloned tag via brief physical proximity to one of the original tags, which results in an attacker being able to bring the alarm system to a disarmed state...

CVE-2024-0414 DeShang DSCMS install.php access control

A vulnerability classified as problematic has been found in DeShang DSCMS up to 3.1.2/7.1. Affected is an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public...