North Korean Hacker Group Andariel Strikes with New EarlyRat Malware

The North Korea-aligned threat actor known as Andariel leveraged a previously undocumented malware called EarlyRat in phishing attacks, adding another piece to the group's wide-ranging toolset. "Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from...

North Korean Hacker Group Andariel Strikes with New EarlyRat Malware

The North Korea-aligned threat actor known as Andariel leveraged a previously undocumented malware called EarlyRat in phishing attacks, adding another piece to the group's wide-ranging toolset. "Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from...

chromium -- multiple vulnerabilities

Chrome Releases reports: This update includes 4 security fixes: 1452137 High CVE-2023-3420: Type Confusion in V8. Reported by Man Yue Mo of GitHub Security Lab on 2023-06-07 1447568 High CVE-2023-3421: Use after free in Media. Reported by Piotr Bania of Cisco Talos on 2023-05-22 1450397 High...

GitHub Security Lab: [Python] Unsafe Unpacking and TarSlip bug slaying

Vulnerability description not provided...

Siemens SICAM A8000 Devices

​​As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services ...

Anevia Flamingo XL/XS 3.6.x Default/Hard-coded Credentials

Summary Flamingo XL, a new modular and high-density IPTV head-end product for hospitality and corporate markets. Flamingo XL captures live TV and radio content from satellite, cable, digital terrestrial and analog sources before streaming it over IP networks to STBs, PCs or other IP-connected...

GitHub Security Lab: cpp: if (a+b>c) a=c-b is incorrect if a+b overflows

Vulnerability description not provided...

GitHub Security Lab: JavaScript: Add some new XSS sinks and sources of Next.js (and some extra improvements)

Vulnerability description not provided...

networks.gersteinlab.org Cross Site Scripting vulnerability OBB-3392667

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Debian dla-3442 : jupyter-nbconvert - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3442 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3442-1 [email protected] https://www.debian.org/lts/security/...

GHSA-X7FR-PG8F-93F5 sccache vulnerable to privilege escalation if server is run as root

Impact On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LDPRELOAD. If the server is run as root which is the default when installing the snap package, this means a user running the sccache...

GitHub Security Lab: [Python] Add Unicode Bypass Validation query tests and help

Vulnerability description not provided...

GitHub Security Lab: [Javascript]: Add new queries for Javascript Github Actions

Vulnerability description not provided...

[slackware-security] ntfs-3g

New ntfs-3g packages are available for Slackware 14.2 and 15.0 to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/ntfs-3g-2022.10.3-i586-1slack15.0.txz: Upgraded. Fixed vulnerabilities that may allow an attacker using a maliciously crafted...

CVE-2022-47174

Cross-Site Request Forgery CSRF vulnerability in WordPress Performance Team Performance Lab plugin = 2.2.0 versions...

CVE-2022-47174

Cross-Site Request Forgery CSRF vulnerability in WordPress Performance Team Performance Lab plugin = 2.2.0 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in WordPress Performance Team Performance Lab plugin = 2.2.0 versions...

CVE-2022-47174 WordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WordPress Performance Team Performance Lab plugin = 2.2.0 versions...

CVE-2022-47174

CVE-2022-47174 is a CSRF vulnerability in the WordPress WordPress Performance Lab plugin, affecting versions

CVE-2022-47174 WordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WordPress Performance Team Performance Lab plugin = 2.2.0 versions...