CVE-2023-4911: Looney Tunables – Local Privilege Escalation in the glibc’s ld.so

The Qualys Threat Research Unit TRU has discovered a buffer overflow vulnerability in GNU C Librarys dynamic loaders processing of the GLIBCTUNABLES environment variable. We have successfully identified and exploited this vulnerability a local privilege escalation that grants full root privileges...

Friday Squid Blogging: Protecting Cephalopods in Medical Research

From Nature: Cephalopods such as octopuses and squid could soon receive the same legal protection as mice and monkeys do when they are used in research. On 7 September, the US National Institutes of Health NIH asked for feedback on proposed guidelines that, for the first time in the United States...

surrey-research-park.com Cross Site Scripting vulnerability OBB-3711610

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mastering API Security: Learn the 3 Key Principles at Kong API Summit 2023

In an era where APIs Application Programming Interfaces are the lifeblood of digital interactions, the need for robust API security has never been more critical. According to Gartner research, a staggering 90% of web-enabled applications are predicted to harbor vulnerabilities related to APIs. To...

Malicious code in @ltd2research/tldrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b91e4540f7f53e684e429ddaece0e59adb5e02fb0e24c2faef4200ee61771875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for Command Injection in Vmware Aria_Operations_For_Networks

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations f...

Friday Squid Blogging: New Squid Species

An ancient squid: New research on fossils has revealed that a vampire-like ancient squid haunted Earths oceans 165 million years ago. The study, published in June edition of the journal Papers in Palaeontology, says the creature had a bullet-shaped body with luminous organs, eight arms and sucker...

BBTok Malware Returns, Targeting Over 40 Banks in Brazil and Mexico

By Deeba Ahmed New BBTok Banking Trojan Variant Emerges in Latin America: Check Point Research. This is a post from HackRead.com Read the original post: BBTok Malware Returns, Targeting Over 40 Banks in Brazil and Mexico...

RUSTSEC-2023-0063 Denial of service in Quinn servers

Receiving QUIC frames containing a frame with unknown frame type could lead to a panic. Unfortunately this is issue was not found by our fuzzing infrastructure. Thanks to the QUIC Tester research group for reporting this issue...

China Accuses U.S. of Decade-Long Cyber Espionage Campaign Against Huawei Servers

China's Ministry of State Security MSS has accused the U.S. of breaking into Huawei's servers, stealing critical data, and implanting backdoors since 2009, amid mounting geopolitical tensions between the two countries. In a message posted on WeChat, the government authority said U.S. intelligence...

Rockwell Automation FactoryTalk View Machine Edition

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : FactoryTalk View Machine Edition Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

Command Execution Vulnerability in Reporter System of Fujian Strait Information Technology Co. Ltd (CNVD-2023-81306)

Fujian Strait Information Technology Co., Ltd. is one of the earliest companies in China specializing in independent research and development of network security, product sales and security services. A command execution vulnerability exists in the Reporter system of Fujian Strait Information...

CVE-2023-41901

Rejected reason: Further research determined the issue is not a vulnerability...

CVE-2023-38139

creationtimestamp| type| source ---|---|--- 2023-09-12 20:29:16+00:00| seen| https://t.me/cibsecurity/70325 2023-10-01 12:50:40+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9121 2024-04-18 16:45:00+00:00| seen|...

Risk Fact #5: Keeping the Pace of Remediation at Cloud Scale Requires Automation

Qualys Blog Series – 2023 TotalCloud Security Insights by the Threat Research Unit The 2023 TotalCloud Security Insights report from the Qualys Threat Research Unit TRU provides research insights, best practices, and detailed recommendations organized by five separate Risk Facts. The insights wil...

You can try to hide your firmware from Kelly Patterson, but she’ll find it (and break it)

How her work illustrates the difference Talos vulnerability research team makes When Kelly Patterson first learned how to code by making small programs in her high school class, she preferred breaking her creations to building them. Shed make a game and then spend double the time debugging that...

Storm-0558 Update: Takeaways from Microsoft's recent report

The Wiz research team examines Microsoft's latest Storm-0558 findings and summarizes the key learnings cloud customers should take away from the incident...

security-research

Security Research This project hosts security advisories and...

The Bug Report – August 2023 Edition

The Bug Report – August 2023 Edition By Charles McFarland · September 06, 2023 Why am I here? Welcome back to The Bug Report, the hotter-than-hell Texas edition! For those still unfamiliar with our monthly escapades, every month our trusty Advanced Research Center vulnerability research team...

Inconsistencies in the Common Vulnerability Scoring System (CVSS)

Interesting research: Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities Abstract: The Common Vulnerability Scoring System CVSS is a popular method for evaluating the severity of vulnerabilities in vulnerability management. In th...