XINJE XD

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low attack complexity/public exploits are available Vendor: XINJE Equipment: XINJE XD Programing Tool Vulnerabilities: Relative Path Traversal, Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of these vulnerabilities could...

APT15 enhanced its arsenal with an updated variant of the Turian backdoor

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary APT15 has modified its toolkit to include new variants of the Turian backdoor, as well as new command and control infrastructure. The malware contains VMProtect, which obfuscates all API calls within the...

Hack the Pentagon 3.0: Groundbreaking Bug Bounty Program Is Back

By Habiba Rashid The US military seeks public help in securing its critical cyber infrastructure with "Hack the Pentagon 3.0" bug bounty program. This is a post from HackRead.com Read the original post: Hack the Pentagon 3.0: Groundbreaking Bug Bounty Program Is Back...

CircleCI: Malware stole GitHub OAuth keys, bypassing 2FA

Software development service company CircleCI has published its incident report on a breach that happened in December. CircleCI revealed an engineer's laptop was successfully infected with a yet-to-be-named information-stealing Trojan, which was used to steal an engineer's session cookie. The...

CVE-2023-21859

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Access Manager...

Design/Logic Flaw

Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications component: Customer, Config, Pricing Manager. Supported versions that are affected are 12.0.0.3.0-12.0.0.7.0. Easily exploitable vulnerability allows high privileged attacker wit...

CVE-2023-21889

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

Buffer overflow

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

Buffer overflow

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

Design/Logic Flaw

Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware component: NextGen Installer issues. Supported versions that are affected are Prior to 13.9.4.2.11. Easily exploitable vulnerability allows low privileged attacker with logon to the...

Oracle Communications Applications security vulnerabilities

Oracle Communications Applications is an advanced communications and collaboration services application from Oracle Corporation. A security vulnerability exists in Oracle Communications BRM that can be exploited by an attacker to allow an elevated privilege attacker to log in to the infrastructur...

Oracle VM VirtualBox security vulnerabilities

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05475)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

Oracle VM VirtualBox has an unspecified vulnerability (CNVD-2023-05477)

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

Oracle VM VirtualBox security vulnerabilities

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can compromise Oracle VM VirtualBox by logging into the infrastructure where Oracle VM VirtualBox is executing...

CVE-2023-21898

CVE-2023-21898 affects Oracle VM VirtualBox (Core). Affected: VirtualBox versions prior to 6.1.42 and prior to 7.0.6. A low-privilege, local attacker with logon can exploit this to cause a hang or a frequent crash of Oracle VM VirtualBox (complete DOS) on Windows guests (noted for VirtualBox VMs ...

CVE-2023-21898

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.42 and prior to 7.0.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...

University suffers leaks, shutdowns at the hands of Vice Society

The Vice Society ransomware gang is back and making some unfortunate waves in the education sector. According to Bleeping Computer, the Society has held their ransomware laden hands up and admitted an attack on the University of Duisberg-Essen. Sadly this isnt the Universitys first encounter with...

Netdata Licensing Issue Vulnerability

Netdata is a high-fidelity infrastructure monitoring and troubleshooting application open-sourced by Netdata.Netdata suffers from an authorization issue vulnerability that stems from the fact that anyone with access to the Netdata agent can access its MACHINEGUID.No details of the vulnerability a...

Pro-Russian Hacktivist Group NoName057(16) Launches Cyber Attacks on Ukraine and NATO Organizations

Threat Level Actors Report For a detailed threat advisory, download the pdf file here Summary NoName05716 is a pro-Russian hacktivist group that has been conducting a campaign of DDoS attacks on Ukraine and NATO organizations since the early days of the war in Ukraine. The group has targeted...