Malicious Package

Overview s3tranfer is a malicious package. It attempts typosquatting popular packages. The malicious script is base64 obfuscated located in init.py file and tries to steal the current username, platform and IP information and send them to a remote host. Malicious behavior python import getpass...

Critical Infrastructure at Risk from New Vulnerabilities Found in Wireless IIoT Devices

A set of 38 security vulnerabilities has been uncovered in wireless industrial internet of things IIoT devices from four different vendors that could pose a significant attack surface for threat actors looking to exploit operational technology OT environments. "Threat actors can exploit...

PT-2023-12811 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem affected versions not specified Description: The issue is related to a denial of service in the modem due to a missing null check while processing IP packets with padding. Recommendations: At the moment, there is no information about a...

Helm 信息泄露漏洞

Helm is a Kubernetes package manager. An information disclosure vulnerability exists in versions of Helm prior to 3.11.1, which stems from the fact that information passed to the charts may be disclosed to the DNS servers used to look up IP addresses...

Internet Bug Bounty: Open Redirect Vulnerability in Action Pack

An open redirect vulnerability was discovered in Action Pack, specifically in the redirectto helper function. This vulnerability allowed for the possibility of an attacker to craft a URL that could bypass the protection against open redirects introduced in Rails 7.0. The vulnerability was fixed i...

On the 20th Safer Internet Day, what was security like back in 2004?

Today is the 20th Safer Internet Day. Since 2004, there's been an annual event designed to "Promote safer and more responsible use of online technology and mobile phones, especially amongst children and young people across the world." 2004 was a key year for several safety activities, encompassin...

[SECURITY] Fedora 37 Update: syncthing-1.23.0-2.fc37

Syncthing replaces other file synchronization services with something open, trustworthy and decentralized. Your data is your data alone and you deserve to choose where it is stored, if it is shared with some third party and how it's transmitted over the Internet. Using syncthing, that control is...

An ever green, ever great way to learn Spring

I could do this post every week. Wait, I do do this post every week! It's called This Week in Spring, and in it I recap a lot of interesting new bits of content on the internet that elaborate or introduce or innovate. I love those points of data. They help. But they're almost never a full-guided...

The vulnerability of the iotdb-web-workbench component of the IoT database for Apache IoTDB allows a hacker to escalate their privileges.

The vulnerability of the iotdb-web-workbench component of the IoT database solution from Apache IoTDB is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker to enhance their privileges remotely...

New Threat: Stealthy HeadCrab Malware Compromised Over 1,200 Redis Servers

At least 1,200 Redis database servers worldwide have been corralled into a botnet using an "elusive and severe threat" dubbed HeadCrab since early September 2021. "This advanced threat actor utilizes a state-of-the-art, custom-made malware that is undetectable by agentless and traditional...

Fedora: Security Advisory for seamonkey (FEDORA-2023-9695066ded)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-0394

...

[SECURITY] Fedora 36 Update: seamonkey-2.53.15-1.fc36

SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...

[SECURITY] Fedora 37 Update: seamonkey-2.53.15-1.fc37

SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...

Veeam One Web Client / Reporter: Access Denied Error

Challenge When attempting to access the Veeam ONE Web Client, formerly known as Veeam ONE Reporter, the following error is shown on the login page: Veeam ONE Web Client Error Access denied Here is what you can do: Go Home Error Variant 1 Error Variant 2 Cause The Internet Information Services IIS...

Fedora: Security Advisory for seamonkey (FEDORA-2023-dfeb282345)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices

Researchers are warning about a spike in exploitation attempts weaponizing a now-patched critical remote code execution flaw in Realtek Jungle SDK since the start of August 2022. According to Palo Alto Networks Unit 42, the ongoing campaign is said to have recorded 134 million exploit attempts as...

The vulnerability in the implementation of the Internet Key Exchange (IKE) protocol in Windows operating systems allows a hacker to induce a service failure.

The vulnerability of the Internet Key Exchange IKE protocol implementation in Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted packets...

Sierra Wireless ALEOS 操作系统命令注入漏洞

Sierra Wireless ALEOS AAF is a framework for creating applications in Sierra Wireless AirLink gateways from Sierra Wireless Canada. A security vulnerability exists in Sierra Wireless ALEOS that originates from a user with valid credentials being able to manipulate IP records to execute arbitrary...

It’s Data Privacy Day: Here’s how to protect your data and become your own privacy champion

News, Security It’s Data Privacy Day: Here’s how to protect your data and become your own privacy champion Share January 27th, 2023 Hello readers! January 28 is Data Privacy Day – an annual celebration of all things data protection and online privacy! It’s an opportunity for businesses and users ...