CVE-2022-23522 Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdb

MindsDB is an open source machine learning platform. An unsafe extraction is being performed using shutil.unpackarchive from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. This vulnerability is sometimes called a TarSlip or a ZipSlip...

CVE-2022-42430

creationtimestamp| type| source ---|---|--- 2023-03-29 22:32:11+00:00| seen| https://t.me/cibsecurity/61131 2023-11-25 04:41:43+00:00| seen| https://t.me/arpsyndicate/571 2023-12-10 13:32:19+00:00| seen| https://t.me/arpsyndicate/1628...

Fake Tor Browser Installers Distributing Clipper Malware

By Deeba Ahmed It is yet unclear how these fake Tor browser installations are distributed but there are indications that torrents or third-party sources may be responsible. This is a post from HackRead.com Read the original post: Fake Tor Browser Installers Distributing Clipper Malware...

Trojanized TOR Browser Installers Spreading Crypto-Stealing Clipper Malware

Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022. "Clipboard injectors ... can be silent for years, show no network activity or any other signs of presence...

PT-2023-5863 · Autodesk · Autodesk Fbx-Sdk

Name of the Vulnerable Software and Affected Versions: Autodesk FBX SDK versions 2020 and prior Description: The issue is related to a heap buffer overflow vulnerability that can be exploited by opening a malicious FBX file, potentially leading to code execution. This vulnerability may allow an...

PT-2023-20005 · Stimulsoft · Stimulsoft Reporting Designer +1

Name of the Vulnerable Software and Affected Versions: Stimulsoft Designer Web version 2023.1.3 Description: The issue allows an attacker to perform Server Side Request Forgery SSRF attacks. The Reporting Designer Web can embed sources from external locations, and when a user chooses such a...

CVE-2023-25262

Stimulsoft GmbH Stimulsoft Designer Web 2023.1.3 is vulnerable to Server Side Request Forgery SSRF. TThe Reporting Designer Web offers the possibility to embed sources from external locations. If the user chooses an external location, the request to that resource is performed by the server rather...

PT-2023-22032 · Mylink · Mydlink+

Name of the Vulnerable Software and Affected Versions: MyLink infotainment system version 2021.3.26 Description: The issue allows attackers to cause a denial of service, resulting in a temporary failure of Media Player functionality, via a crafted MP3 file. Recommendations: For MyLink infotainmen...

PT-2023-4696 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.3 Description: An out-of-bounds read issue was addressed with improved input validation. Processing an image may result in disclosure of process memory. This issue may allow an attacker to gain unauthorized access t...

CVE-2023-28760

creationtimestamp| type| source ---|---|--- 2023-03-24 12:53:44+00:00| published-proof-of-concept| https://t.me/crackcodes/2821 2023-03-24 15:39:00+00:00| published-proof-of-concept| Telegram/Gyrvv86AbWrB1GT84Y-sUOl1kYGUEvQAgiox85A6xDMevbQ 2023-03-24 15:59:08+00:00| published-proof-of-concept|...

CVE-2023-22702

creationtimestamp| type| source ---|---|--- 2023-03-23 17:41:49+00:00| seen| https://t.me/cibsecurity/60575 2023-03-28 16:13:15+00:00| seen| https://t.me/thebugbountyhunter/7166 2023-03-31 22:21:31+00:00| seen| Telegram/si0-pdQ52ax8fXd0ZUWfsz3qvh34q1lqaolJbKduSMAvfXE 2023-04-18 14:47:21+00:00|...

CVE-2023-28769

creationtimestamp| type| source ---|---|--- 2023-03-21 19:23:14+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/zyxelmultipledeviceszhttplanrce.rb 2023-06-22 12:15:21+00:00| seen| MISP/1c355568-696d-46a8-b7e7-3022bb8d3143 2025-02-06...

Malware creator who compromised 10,000 computers arrested

The creator of a Remote Access Trojan RAT, responsible for compromising more than 10,000 computers, has been arrested by law enforcement in Ukraine. At the time of the arrest, the developer still had real-time access to 600 PCs. According to the announcement, the RAT could tell infected devices t...

CVE-2023-27535

creationtimestamp| type| source ---|---|--- 2023-03-20 23:31:53+00:00| seen| https://t.me/ctinow/100329 2023-03-31 00:37:51+00:00| seen| https://t.me/cibsecurity/61216...

Microsoft achieves first native Cloud Data Management Capabilities certification

Today, Microsoft announced the successful completion of the Cloud Data Management Capabilities CDMC 14 Key Controls and Automations certification, conducted by Accenture and Avanade, accelerating the industry’s move to the cloud. The 14 Key Controls and Automations are a part of the EDM Council’s...

CVE-2023-27537

creationtimestamp| type| source ---|---|--- 2023-03-20 13:41:41+00:00| seen| https://t.me/ctinow/100169 2023-03-23 07:51:18+00:00| seen| https://t.me/ctinow/100958 2023-03-31 00:31:46+00:00| seen| https://t.me/cibsecurity/61206...

CBL Mariner 2.0 Security Update: libtiff (CVE-2023-0800)

The version of libtiff installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-0800 advisory. - LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a...

CVE-2023-28115

creationtimestamp| type| source ---|---|--- 2023-03-17 14:49:52+00:00| published-proof-of-concept| https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc 2023-03-18 01:31:50+00:00| seen| https://t.me/cibsecurity/60277 2023-03-23 11:05:11+00:00| published-proof-of-concept|...

CVE-2023-26359

creationtimestamp| type| source ---|---|--- 2023-03-15 07:54:44+00:00| exploited| https://t.me/kasperskyb2b/516 2023-03-23 23:36:57+00:00| seen| https://t.me/cibsecurity/60620 2023-04-04 06:27:25+00:00| published-proof-of-concept| https://t.me/ptswarm/169 2023-04-04 15:51:44+00:00| seen|...

CVE-2023-26360

creationtimestamp| type| source ---|---|--- 2023-03-15 07:54:44+00:00| exploited| https://t.me/kasperskyb2b/516 2023-03-16 06:41:59+00:00| exploited| https://t.me/KomunitiSiber/65 2023-03-16 06:47:18+00:00| exploited| https://t.me/thehackernews/3153 2023-04-04 15:51:44+00:00| seen|...