9871 matches found
CVE-2022-4304
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages fo...
UBUNTU-CVE-2022-4304
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages fo...
New SH1MMER Exploit for Chromebook Unenrolls Managed ChromeOS Devices
A new exploit has been devised to "unenroll" enterprise- or school-managed Chromebooks from administrative control. Enrolling ChromeOS devices makes it possible to enforce device policies as set by the organization via the Google Admin console, including the features that are available to users...
New SH1MMER Exploit for Chromebook Unenrolls Managed ChromeOS Devices
A new exploit has been devised to "unenroll" enterprise- or school-managed Chromebooks from administrative control. Enrolling ChromeOS devices makes it possible to enforce device policies as set by the organization via the Google Admin console, including the features that are available to users...
The Untold Story of a Crippling Ransomware Attack
More than two years ago, criminals crippled the systems of London’s Hackney Council. It's still fighting to recover...
EulerOS Virtualization 3.0.2.2 : libgcrypt (EulerOS-SA-2023-1266)
According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a...
Dell PowerProtect Cyber Recovery Installed (Linux)
Binary data dellcyberrecoverynixinstalled.nbin...
Account Takeover via reset password
Description Password recovery leads to Account Take Over due to reset code leakage. Proof of Concept Create an acount in https://meta.answer.dev/ and verify mail, then log out. Go to password recovery https://meta.answer.dev/users/account-recovery, insert your email and capture the server respons...
FusionCMS (FusionGen) Takeover account - Predictable Key and Password Generation in Password Recovery Feature
Description It was discovered that the password recovery feature on the website is vulnerable to predictable key and password generation. An attacker is able to predict the key used in the password recovery process and the generated password itself by using a specific PHP command and the user's...
Ransomware Recovery Plan for 2023
It’s important to defend against ransomware attacks, but is your organization prepared to deal with the consequences of a breach? Find out how to plan an effective ransomware recovery strategy...
PT-2023-1356 · Vmware · Vrealize Log Insight
Name of the Vulnerable Software and Affected Versions: vRealize Log Insight affected versions not specified Description: The issue is related to a deserialization vulnerability in vRealize Log Insight, which can be exploited by an unauthenticated malicious actor to trigger the deserialization of...
Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls_mpi_exp_mod() in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information (typically an untrusted operating system attacking a secure enclave such as SGX or the TrustZone secure world) to recover the private keys used in RSA.
...
CVE-2023-24069
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker ca...
CVE-2023-24069
Signal Desktop before 6.2.0 (Windows/Linux/macOS) is affected by CVE-2023-24069 and CVE-2023-24068, with confirmed details in Red Hat advisories and NVD/osv entries. The issue centers on attachments.noindex: attackers with local filesystem access can access potentially sensitive attachments store...
Moderate: libreoffice security update
LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...
CVE-2023-24069
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker ca...
The vulnerability of the recovery mechanism of G Data antivirus software allows attackers to enhance their privileges.
The vulnerability of the file recovery mechanism of the G Data antivirus software is related to incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow a malicious actor, operating remotely, to increase their privileges...
CVE-2023-24069
Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages from the attachments.noindex directory. Cached attachments are not effectively cleared. In some cases, even after a self-initiated file deletion, an attacker ca...
RHEL 9 : libreoffice (RHSA-2023:0304)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0304 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor...
Trend Micro Maximum Security 安全漏洞
Trend Micro Maximum Security is a set of computer security protection software from Trend Micro. The software includes virus detection, malware protection, and authentication protection. A security vulnerability exists in Trend Micro Maximum Security version 2022 17.7. An attacker could exploit t...