New Go-based Backdoor GoGra Targets South Asian Media Organization

An unnamed media organization in South Asia was targeted in November 20233 using a previously undocumented Go-based backdoor called GoGra. "GoGra is written in Go and uses the Microsoft Graph API to interact with a command-and-control C&C server hosted on Microsoft mail services," Symantec, part ...

krb5: GSS message token handling

A vulnerability was found in the MIT Kerberos 5 GSS krb5 wrap token, where an attacker can modify the plaintext Extra Count field, causing the unwrapped token to appear truncated to the application, occurs when the attacker alters the token data during transmission which can lead to improper...

Security Bulletin: IBM Sterling Connect:Direct Web Service is vulnerable to Bouncy Castle BC-FJA

Summary IBM Sterling Connect:Direct Web Service 6.1 and 6.2 is vulnerable to BC version 1.75 . We have upgraded to version 1.78 to fix CVE-2022-45146. Vulnerability Details CVEID:CVE-2022-45146 DESCRIPTION: The Legion of the Bouncy Castle BC-FJA could allow a remote attacker to obtain sensitive...

CVE-2024-34606

Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34605

Improper access control in SamsungHealthService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34609

Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34604

Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34609

Improper access control in VoiceNoteService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34608

The CVE-2024-34608 issue is an improper access control in PaymentManagerService prior to the SMR Aug-2024 Release 1, enabling local attackers to bypass restrictions on starting background services. Publicly noted in multiple sources, the vulnerability affects PaymentManagerService versions earlie...

CVE-2024-34608

Improper access control in PaymentManagerService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34607

Improper access control in SamsungNotesService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34606

Improper access control in SmartThingsService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34604

Improper access control in LedCoverService prior to SMR Aug-2024 Release 1 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-34604

CVE-2024-34604 involves improper access control in LedCoverService prior to SMR Aug-2024 Release 1, allowing a local attacker to bypass restrictions on starting services from the background. Affected component: LedCoverService. Root cause: access-control weaknesses enabling background-start bypas...

PT-2024-26023 · Unknown · Paymentmanagerservice

Name of the Vulnerable Software and Affected Versions: PaymentManagerService versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper access control in the PaymentManagerService, allowing local attackers to bypass restrictions on starting services from the background...

PT-2024-26021 · Unknown · Smartthingsservice

Name of the Vulnerable Software and Affected Versions: SmartThingsService versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper access control in SmartThingsService, allowing local attackers to bypass restrictions on starting services from the background...

PT-2024-5722 · Cisco · Cisco Identity Services Engine

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue exists due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this...

DEBIAN-CVE-2024-7531

Calling PK11Encrypt in NSS using CKMCHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcom...

2024 Midyear Threat Landscape Review

As we navigate the complexities of 2024, its crucial to pause and reflect on the evolving threat landscape that surrounds us. This moment offers a unique opportunity to scrutinize our triumphs and missteps, understand the events that have decisively shaped our environment, and consider those that...

httpd: Encoding problem in mod_proxy

A flaw was found in the modproxy module of httpd. Due to an encoding problem, specially crafted request URLs with incorrect encoding can be sent to backend services, potentially bypassing authentication...