Chinese Hackers Exploited New Zero-Day in Barracuda's ESG Appliances

Barracuda has revealed that Chinese threat actors exploited a new zero-day in its Email Security Gateway ESG appliances to deploy backdoors on a "limited number" of devices. Tracked as CVE-2023-7102, the issue relates to a case of arbitrary code execution that resides within a third-party and...

CVE-2023-7101

creationtimestamp| type| source ---|---|--- 2023-12-24 23:26:30+00:00| seen| https://t.me/ctinow/159097 2023-12-26 14:20:06+00:00| exploited| https://t.me/truesecator/5247 2023-12-27 09:36:05+00:00| seen| MISP/3eeca3ec-69cf-4e93-9283-db148ac21b9b 2023-12-27 22:00:08+00:00| seen|...

CVE-2023-45125

creationtimestamp| type| source ---|---|--- 2023-12-21 20:22:31+00:00| seen| https://t.me/ctinow/157935 2023-12-28 23:16:46+00:00| seen| https://t.me/ctinow/160236...

CVE-2023-50988

creationtimestamp| type| source ---|---|--- 2023-12-20 23:42:32+00:00| seen| https://t.me/ctinow/157392 2023-12-22 23:17:02+00:00| seen| https://t.me/ctinow/158655 2024-01-14 08:07:01+00:00| seen| https://t.me/ctinow/167953...

CVE-2023-38519

creationtimestamp| type| source ---|---|--- 2023-12-20 15:23:24+00:00| seen| https://t.me/ctinow/157076 2024-01-13 14:51:36+00:00| seen| https://t.me/ctinow/167839...

Timing Attack

generator-jhipster is vulnerable to a Timing Attack. The vulnerability exists because the TokenProvider.java uses String.equalsstr to compare the given token-signature. This comparison method does not effectively validate the token because it stops as soon as it encounters the first character tha...

CVE-2018-19410

creationtimestamp| type| source ---|---|--- 2023-08-13 04:23:57+00:00| seen| Telegram/tHVp3sdNlkRDzfv9Qq4ZJOHfg2IUdOjUFDh-U42wp7kJAA 2025-02-04 15:42:20+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113946377498057596 2025-02-04 17:33:15+00:00| seen|...

CVE-2023-38205

creationtimestamp| type| source ---|---|--- 2023-07-20 05:34:05+00:00| exploited| https://t.me/thehackernews/3620 2023-07-20 06:46:04+00:00| exploited| https://t.me/KomunitiSiber/515 2023-07-20 07:09:27+00:00| exploited| Telegram/m5JSB14XcE4WmSFl9S5T7USgeuaPM5JvS0hspkLyulXfQ 2023-07-20...

Vault.sponsor may take away the prize chance from the receiver.

Lines of code Vulnerability details Impact TwabController.delegateBalance is related to the probability to get the prize, and Vault.sponsor can make the others' delegateBalance to 0. A malicious user can send a small amount of assets to every depositor and be the only prize taker. Proof of Concep...

CVE-2023-36517

creationtimestamp| type| source ---|---|--- 2023-07-11 12:42:45+00:00| seen| https://t.me/cibsecurity/66330...

CVE-2019-8451

creationtimestamp| type| source ---|---|--- 2023-06-16 15:55:55+00:00| seen| https://t.me/criticalbug/975 2023-11-17 08:44:59+00:00| seen| https://t.me/arpsyndicate/242 2024-03-18 07:23:33+00:00| published-proof-of-concept| https://t.me/lostsec/164 2024-10-09 19:49:41+00:00| seen|...

CVE-2023-0853

creationtimestamp| type| source ---|---|--- 2023-05-11 16:15:26+00:00| seen| https://t.me/cibsecurity/63881...

CVE-2023-2096

creationtimestamp| type| source ---|---|--- 2023-04-15 14:36:43+00:00| seen| https://t.me/cibsecurity/62218 2023-11-25 05:39:26+00:00| seen| https://t.me/arpsyndicate/574 2023-12-10 14:53:45+00:00| seen| https://t.me/arpsyndicate/1640...

CVE-2021-27876

creationtimestamp| type| source ---|---|--- 2022-09-23 16:55:16+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/veritas/beagentshaauthrce.rb 2023-04-11 08:50:00+00:00| exploited| https://t.me/KomunitiSiber/83 2023-06-14 21:10:04+00:00| seen|...

Sudden price fluctuations occuring at a call to _update() will not be reflected by reserves(), sampleReserves() and sampleSupply() until after periodSize seconds

Lines of code Vulnerability details Impact Consider the situation where a token suddenly drops drastically in price in the market. Consider a call to BaseV1Pair.swap which makes a very large swap between the two tokens accurately reflecting the change in price and also causes a new observation to...

blockTimestampLast not initialised to block.timestamp results in wrong calculations for reservesCumulative and totalSupplyCumulative in _update() function

Lines of code Vulnerability details Impact Default value of blockTimestampLast is 0 and affects the calculations done in the first call of update. observations would store the wrong value and affect subsequent calculations of price when a sample size that includes this wrong observation is taken...

CVE-2022-38766

creationtimestamp| type| source ---|---|--- 2022-08-26 16:58:46+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/3048 2022-08-29 11:37:02+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/6693 2022-09-27 07:30:24+00:00| published-proof-of-concept|...

CVE-2022-2314

creationtimestamp| type| source ---|---|--- 2022-08-15 14:37:48+00:00| seen| https://t.me/cibsecurity/48135 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-02-09 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-02-09...

CVE-2022-2487

creationtimestamp| type| source ---|---|--- 2022-07-20 16:19:56+00:00| seen| https://t.me/cibsecurity/46638 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-02-08 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-02-08...

period size is incorrectly set

Lines of code Vulnerability details Impact Instead of setting periodSize to 1800 30 min, it is currently set to 0 which means new observations will get added each time update is called at BaseV1-core.solL166 Proof of Concept 1. Observe that periodSize is set to 0 2. BaseV1-core.solL166 will alway...