Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure

The coordinated cyberattacks targeting Ukrainian government websites and the deployment of a data-wiper malware called WhisperGate on select government systems are part of a broader wave of malicious activities aimed at sabotaging critical infrastructure in the country. The Secret Service of...

CVE-2022-22173

A Missing Release of Memory after Effective Lifetime vulnerability in the Public Key Infrastructure daemon pkid of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service DoS. In a scenario where Public Key Infrastructure PKI is used in combination with...

CVE-2022-22173

A Missing Release of Memory after Effective Lifetime vulnerability in the Public Key Infrastructure daemon pkid of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause Denial of Service DoS. In a scenario where Public Key Infrastructure PKI is used in combination with...

CVE-2021-33912

libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code via an unauthenticated e-mail message from anywhere on the Internet with a crafted SPF DNS record, because of incorrect sprintf usage in SPFrecordexpanddata in spfexpand.c...

CVE-2021-33913

libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code via an unauthenticated e-mail message from anywhere on the Internet with a crafted SPF DNS record, because of SPFrecordexpanddata in spfexpand.c. The amount of overflowed data depend...

CVE-2021-35687: Undefined Security Weakness

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications component: Unified Metadata Manager. Supported versions that are affected are 8.0.7-8.1.1. Easily exploitable vulnerability allows unauthenticated attacker with...

CVE-2021-35686: Undefined Security Weakness

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications component: Unified Metadata Manager. Supported versions that are affected are 8.0.7-8.1.1. Easily exploitable vulnerability allows low privileged attacker with...

Oracle Financial Services Applications security vulnerabilities

Oracle Financial Services Applications is a set of financial services software from Oracle. The product includes core banking, online banking, and property management, etc. Financial Services Analytical Applications Infrastructure is one of the financial services analytical applications...

CVE-2021-33912

libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code via an unauthenticated e-mail message from anywhere on the Internet with a crafted SPF DNS record, because of incorrect sprintf usage in SPFrecordexpanddata in spfexpand.c...

Oracle VM VirtualBox (Jan 2022 CPU)

The version of VirtualBox installed on the remote host is prior to 6.1.32. It is, therefore, affected by multiple vulnerabilities as referenced in the January 2022 CPU advisory: - Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM...

Oracle VM VirtualBox (Jan 2022 CPU) (macOS)

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

Vulnerabilities fixed in Oracle Financial Services Applications

Oracle has fixed vulnerabilities in the following Oracle Financial Services Applications products: Financial Services Analytical Applications Infrastructure FLEXCUBE Investor Servicing FLEXCUBE Private Banking Banking Platform Financial Services Behavior Detection Platform Financial Services...

CVE-2021-33912

libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code via an unauthenticated e-mail message from anywhere on the Internet with a crafted SPF DNS record, because of incorrect sprintf usage in SPFrecordexpanddata in spfexpand.c...

PT-2022-2128

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7 through 8.1.1 Description The issue is related to insufficient input validation in the Unified Metadata Manager component. It allows an unauthenticated attacker wi...

PT-2022-2129

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Analytical Applications Infrastructure versions 8.0.7 through 8.1.1 Description The issue is related to insufficient input validation in the Unified Metadata Manager component. It allows a low-privileged attacker with...

CVE-2022-0184

Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlier allows an attacker on the adjacent network to obtain credentials for connecting to the Wi-Fi access point with the infrastructure mode...

CVE-2022-0184

The CVE-2022-0184 issue affects KING JIM’s TEPRA PRO SR5900P and SR-R7900P label printers (SR5900P ≤1.080; SR-R7900P ≤1.030). The vulnerability is an insufficiently protected credentials flaw that could allow an attacker on an adjacent network to obtain credentials used to connect to the device’s...

PT-2022-13020

Name of the Vulnerable Software and Affected Versions TEPRA PRO SR5900P versions 1.080 and earlier TEPRA PRO SR-R7900P versions 1.030 and earlier Description The issue allows an attacker on the adjacent network to obtain credentials for connecting to the Wi-Fi access point with the infrastructure...

Earth Lusca Employs Sophisticated Infrastructure, Varied Tools and Techniques

Our technical brief provides an in-depth look at Earth Lusca’s activities, the tools it employs in attacks, and the infrastructure it uses...

Binaryen Denial of Service Vulnerability

Binaryen is a compiler infrastructure and toolchain library for WebAssembly written in C++. Binaryen suffers from a denial of service vulnerability in version 104, which stems from an assertion abort in the software wasm::WasmBinaryBuilder::VisitRetrow, that can be exploited by an attacker to cau...