New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

By Jungsoo An, Wayne Lee and Vanja Svajcer. Cisco Talos discovered a new, stealthy espionage campaign that has likely persisted since at least March 2021. The observed activity affects an Islamic non-profit organization using backdoors for a previously unreported malware family we have named...

CVE-2024-25558

The CVE-2024-25558 entry is associated with Google ChromeOS: the PowerVR GPU driver contains an integer overflow in DevmemIntChangeSparse() that enables controllable out-of-bounds writes. This could lead to memory corruption or elevation of privileges, as described in ChromeOS security notes tied...

CVE-2024-25557

CVE-2024-25557 is tied to the ChromeOS PowerVR GPU driver. The connected PT-2023-8651 entry describes a use-after-free in the PowerVR device-side memory handling, allowing an attacker to read/write arbitrary physical memory from userspace and potentially execute code with elevated privileges. The...

CVE-2024-1281

CVE-2024-1281 is tied to a ChromeOS/ChromeOS Flex issue: a buffer/Out-of-Bounds write in the cam_lrme_mgr_hw_prepare_update function in Chrome OS. The PT security entry for Google Chrome OS (PT-2023-8539) describes a related buffer overflow in the same component, noting privilege-escalation impac...

CVE-2023-49667

CVE-2023-49667 is an UNISOC kernel vulnerability. Connected sources confirm a lack of boundary checking in the cp dump driver, leading to out-of-bounds reads. The issue is reported under Unisoc chipset kernels and is categorized as a kernel‑level flaw. Public details across OSV entries and CNNVD ...

saint-joseph.org Cross Site Scripting vulnerability OBB-3846948

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-50325

The connected IBM PowerSC bulletin details CVE-2023-50325 affecting IBM PowerSC 1.3, 2.0, and 2.1. The issue is a Cross-Origin Resource Sharing (CORS) misconfiguration where domain names are not limited to trusted domains, enabling an attacker to perform privileged actions and access sensitive da...

BIT-LIFERAY-2023-3426

The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations...

CISA and FBI Release Secure by Design Alert Urging Manufacturers to Eliminate Defects in SOHO Routers

Today, CISA and the Federal Bureau of Investigation FBI published guidance on Security Design Improvements for SOHO Device Manufacturers as a part of the new Secure by Design SbD Alert series that focuses on how manufacturers should shift the burden of security away from customers by integrating...

CVE-2019-17997

LayerBB 1.1.3 has a cross-site scripting issue linked to CVE-2019-13972, allowing XSS via the pm_title parameter in application/commands/new.php. The connected records note this as a related issue to CVE-2019-17997, indicating the vector relies on the pm_title input. The documentation confirms th...

CVE-2019-18940

CVE-2019-18976 describes a NULL pointer dereference in res_pjsip_t38.c affecting Sangoma Asterisk up to version 13.x and Certified Asterisk up to 13.21-x. If a re-invite for T.38 faxing arrives and the SDP contains a port of 0 with no c line, a crash can occur. This vulnerability is distinct from...

CVE-2023-23336

CVE-2023-43336 affects Sangoma FreePBX prior to 15.0.18, 16.0.40, 15.0.16, and 16.0.17. The root cause is an access control issue caused by a modified parameter value (for example, changing extension=self to extension=101). This could allow bypass of access controls as described in the connected ...

CVE-2024-22213

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the...

CVE-2024-22213

CVE-2024-22213 affects Nextcloud Deck (kanban-style app) and enables cross-site scripting via HTML submitted as a comment. The root cause is untrusted HTML execution in the Deck comment flow, allowing malicious code to run in a user’s browser. Affected versions include Deck 1.9.x and 1.10.x lines...

CVE-2032-43016

Technical details for CVE-2032-43016 are not publicly available in the provided documents; monitoring for updates is advised.

CVE-2021-234550

CVE-2021-234550 affects IBM Spectrum Control (versions 5.4.0–5.4.5.2). The issue is a Dojo prototype pollution in setObject that could allow a remote attacker to execute arbitrary code by sending a specially crafted request. IBM lists a fix in Spectrum Control v5.4.6. Other related advisories not...

HackerOne: Program admins could add verified domains to an organization

Program admins could add verified domains to an organization in HackerOne despite lacking organization admin permissions. This allowed program admins to access restricted features and escalate privileges...

GitHub Rotates Keys After High-Severity Vulnerability Exposes Credentials

GitHub has revealed that it has rotated some keys in response to a security vulnerability that could be potentially exploited to gain access to credentials within a production container. The Microsoft-owned subsidiary said it was made aware of the problem on December 26, 2023, and that it address...

CVE-2024-0200

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2024-0200

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...