8058 matches found
RSAC 2019: New Operation Sharpshooter Data Reveals Higher Complexity, Scope
SAN FRANCISCO – An insidious reconnaissance campaign discovered in 2018, dubbed Operation Sharpshooter, is much more widespread than previously thought, researchers said. Operation Sharpshooter was first disclosed in December 2018, using a never-before-seen implant framework to infiltrate global...
SQL Injection Vulnerability in the Operation Management System of Elderly Care Facilities
Yi Nursing Institution Operation Management System is a set of information management system for nursing institutions developed by Elephant Communication. SQL injection vulnerability exists in Yi Nursing Care Institution Operation Management System. SQL injection vulnerability exists in the login...
Nablarch Unauthorized Operation Vulnerability
Nablarch is a Java application framework based on the middleware model . A security vulnerability exists in Nablarch versions 5, 5u1 and 5u13. An attacker can exploit the vulnerability to obtain information about stored data, register or modify invalid values...
Researcher: Not Hard for a Hacker to Capsize a Ship at Sea
Maritime transport still contributes in an important way to the world’s economy, with on-time shipments influencing everything from commodities availability and spot pricing to the stability of small countries. Unfortunately, capsizing a ship with a cyberattack is a relatively low-skill enterpris...
undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer
An information leak vulnerability was found in Undertow. If all headers are not written out in the first write call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests...
CVE-2019-8407
HongCMS 3.0.0 is affected by CVE-2019-8407 due to a path traversal in the filename parameter of admin/index.php/language/edit, allowing arbitrary file read and write. The underlying cause is improper handling of "../" in the filename, enabling access to sensitive files. Impact: partial confidenti...
openSUSE Security Update : uriparser (openSUSE-2019-165)
This update for uriparser fixes the following issues : Security issues fixed : - CVE-2018-20721: Fixed an out-of-bounds read for incomplete URIs with IPv6 addresses with embedded IPv4 address bsc1122193. - CVE-2018-19198: Fixed an out-of-bounds write that was possible via the uriComposeQuery or...
Multiple Lexmark Product Input Validation Vulnerabilities
Lexmark is an American developer and manufacturer of printers. An input validation vulnerability exists in multiple Lexmark products, which could be exploited by an attacker to perform a delete operation...
Security update for uriparser (low)
openSUSE Security Update: Security update for uriparser Announcement ID: openSUSE-SU-2019:0171-1 Rating: low References: 1115722 1115723 1115724 1122193 Cross-References: CVE-2018-19198 CVE-2018-19199 CVE-2018-19200 CVE-2018-20721 Affected Products: openSUSE Backports SLE-15 An update that fixes...
CVE-2019-7693
Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx ErrorParameters parameter. In some situations, the XSS would be on the family.axioscloud.it cloud service; however, the vendor also supports "Sissi in Rete con server" for offline operation...
Mozilla Firefox Unauthorized Operation Vulnerability
Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in versions of Mozilla Firefox prior to 65. No details of the vulnerability are provided at this time...
Directory traversal
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned only directory traversal attacks are prevented...
VLC (European Commission - DIGIT): VLC 4.0.0 - Stack Buffer Overflow (SEH)
Summary: Incorrect calculation of Buffer Size in rist module for VLC leading to Stack Overflow with SEH chain overwrite. The modules/access/rist module has an incorrect calculation of buffer size giving an attacker the possibility to set the buffer size of a local variable by sending a maliciousl...
Feds Dismantle Dark Web Credentials Market
Law-enforcement agencies across the world have taken aim at Dark Web denizens this week, with the takedown of a credentials marketplace as well as continued action against former users of the Webstresser.org DDoS-for-hire site. An international law-enforcement operation has dismantled the xDedic...
Police Shut Down xDedic – An Online Market for Cyber Criminals
In an international operation involving law enforcement authorities from the U.S. and several European countries, feds have shut down an online underground marketplace and arrested three suspects in Ukraine. Dubbed xDedic, the illegal online marketplace let cybercriminals buy, sell or rent out...
Police Shut Down xDedic – An Online Market for Cyber Criminals
In an international operation involving law enforcement authorities from the U.S. and several European countries, feds have shut down an online underground marketplace and arrested three suspects in Ukraine. Dubbed xDedic, the illegal online marketplace let cybercriminals buy, sell or rent out...
BEWARD Intercom 2.3.1 Credential Disclosure
!/usr/bin/env python -- coding: utf8 -- BEWARD Intercom 2.3.1 Credentials Disclosure Vendor: Beward R&D Co., Ltd Product web page: https://www.beward.net Affected version: 2.3.1.34471 2.3.0 2.2.11 2.2.10.5 2.2.9 2.2.8.9 2.2.7.4 Note: For versions above 2.2.11: The application data directory, whic...
How to Collect Logs for Veeam Plug-in for Oracle RMAN
Purpose This article documents how to collect the diagnostic information needed for a support case involving the Veeam Plug-in for Oracle RMAN. Solution 1. Collect diagnostic information as documented in the five sections below. 2. Combine the data into a single .zip file. 3. Attach the zip file ...
VLC (European Commission - DIGIT): Buffer overflow in libavi_plugin memmove() call
Summary: When parsing an invalid AVI file, a buffer overflow might occur. Description: The ReadFrame function in the avi.c file uses a variable iwidthbytes, which is obtained directly from the file. It is a signed integer. It does not do a strict check before the memory operationmemmove, memcpy,...
