New Medusa Android Trojan Targets Banking Users Across 7 Countries

Cybersecurity researchers have discovered an updated version of an Android banking trojan called Medusa that has been used to target users in Canada, France, Italy, Spain, Turkey, the U.K., and the U.S. The new fraud campaigns, observed in May 2024 and active since July 2023, manifested through...

[SECURITY] Fedora 39 Update: python-dns-2.6.1-1.fc39

dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG authenticated messages and EDNS0. dnspython provides both high and low level access to DNS. The high level classes perform queries for data...

Exposure of secrets through system log in structs

structs provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their execution. When structs 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secre...

CVE-2024-38306 btrfs: protect folio::private when attaching extent buffer folios

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect folio::private when attaching extent buffer folios BUG Since v6.8 there are rare kernel crashes reported by various people, the common factor is bad page status error messages like this: BUG: Bad page state in...

Malicious code in kendo-react-messages (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-50719

creationtimestamp| type| source ---|---|--- 2024-06-25 11:22:27+00:00| seen| Telegram/7FLFIf95JGKfNqLMN-RJlQXHIDp1TN87HebSEVaBG6vKRw 2024-06-25 11:23:16+00:00| seen| https://t.me/realLulzSec/1070 2024-06-25 11:23:16+00:00| seen| https://t.me/realLulzSec/10111 2024-06-25 12:03:20+00:00|...

EulerOS 2.0 SP11 : python-cryptography (EulerOS-SA-2024-1844)

According to the versions of the python-cryptography package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS server...

PT-2024-28290 · Unknown · Px4-Autopilot

Name of the Vulnerable Software and Affected Versions: PX4-Autopilot version 1.12.3 Description: A buffer overflow in the software allows attackers to cause a Denial of Service DoS via a crafted MavLink message. Recommendations: For PX4-Autopilot version 1.12.3, consider disabling the handling of...

Conduit Security Vulnerabilities

Conduit is a simple, fast and reliable chat server from the individual developer Timo Kösters. A security vulnerability exists in Conduit v0.6.0 and earlier versions, which stems from a failure to check permissions when handling edits, resulting in a local user being able to edit any message from...

Important: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.33.0 security update & enhancements

Release of OpenShift Serverless Logic 1.33.0 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

PT-2025-3822

Name of the Vulnerable Software and Affected Versions Ruby affected versions not specified Description The Ruby interpreter is susceptible to the Marvin Attack, which leverages a covert timing channel to transmit data. This issue allows a remote attacker to decrypt previously encrypted messages o...

CVE-2024-3036 Communication DoS vulnerability

Improper Input Validation vulnerability in ABB 800xA Base. An attacker who successfully exploited this vulnerability could cause services to crash by sending specifically crafted messages. This issue affects 800xA Base: from 6.0.0 through 6.1.1-2...

Linux Kernel TIPC Message Reassembly Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with TIPC bearer enabled are vulnerable. The specific flaw exists within the processing of fragmented TIPC...

Signal Foundation Warns Against EU's Plan to Scan Private Messages for CSAM

A controversial proposal put forth by the European Union to scan users' private messages for detection of child sexual abuse material CSAM poses severe risks to end-to-end encryption E2EE, warned Meredith Whittaker, president of the Signal Foundation, which maintains the privacy-focused messaging...

FRRouting Loop DoS

The vulnerability of the FRRouting software implementation on Unix-like systems lies in the fact that it sends specially crafted welcome messages with a one-to-one distribution flag, an interval field equal to 0, or any TLV containing a mandatory sub-TLV. This allows the attacker to enter an...

CVE-2024-6059

A vulnerability, which was classified as problematic, has been found in Ingenico Estate Manager 2023. This issue affects some unknown processing of the file /emgui/rest/ums/messages of the component News Feed. The manipulation of the argument message leads to cross site scripting. The attack may ...

CVE-2024-37663

Redmi router RB03 v1.0.57 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the victim and any remote server by sending out forged ICMP redirect messages...

CVE-2024-37661

TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redirect message attacks. An attacker in the same WLAN as the victim can hijack the traffic between the victim and any remote server by sending out forged ICMP redirect messages...

CVE-2024-36279

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a...

User ID Enumeration

silverstripe/framework is vulnerable to user ID Enumeration. The vulnerability is due to differing error messages: non-existent users do not receive a locked out message, which allows an attacker to infer or confirm user details that exist in the member table...