15901 matches found
GHSA-GCQ9-QQWX-RGJ3 libp2p nodes vulnerable to OOM attack
Summary In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. It is feasible to do this at scale. An attacker would have to transfe...
Years into these games’ histories, attackers are still creating “Fortnite” and “Roblox”-related scams
Welcome to this weeks edition of the Threat Source newsletter. I have no idea how "Fortnite" keeps coming up in this newsletter, but here we are again. Even though the game/metaverse has never been bigger, it had been a while since I had heard about "V-Bucks" scams. V-Bucks are the in-game virtua...
Cloud Virtual Apps and Desktop - All the users are seeing 2 VDI
Seeing two Desktop VDI icons in Citrix Store instead of one when user is only assigned to one Delivery Group...
CVE-2021-43171
Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the application server to install malicious applications on user's systems by altering the server's API response...
CVE-2021-43171
The CVE affects the e/OS App Lounge app store client (before version 0.19q). The root cause is improper verification of cryptographic signatures, allowing an attacker who controls the app server to install malicious applications by altering the server API response. Impact is high on integrity of ...
CVE-2023-25913
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information...
CVE-2023-25913
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information...
Authentication flaw
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information...
Chrome will soon start removing extensions that may be unsafe
Retroactive removals are finally on the way for malicious Chrome browser extensions. Beginning with Chrome 117, Chrome will "proactively highlight to users when an extension they have installed is no longer in the Chrome web store". Previously, if you installed an extension which was subsequently...
CVE-2023-25913 Authentication Bypass in Danfoss AK-SM800A
Because of an authentication flaw an attacker would be capable of generating a web report that discloses sensitive information such as internal IP addresses, usernames, store names and other sensitive information...
PT-2023-20358 · Danfoss · Ak-Sm800A +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to an authentication flaw that allows an attacker to generate a web report, potentially disclosing sensitive information such as...
camerastorelasvegas.com Cross Site Scripting vulnerability OBB-3597113
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Thousands of Android Malware Apps Using Stealthy APK Compression to Evade Detection
Threat actors are using Android Package APK files with unknown or unsupported compression methods to elude malware analysis. That's according to findings from Zimperium, which found 3,300 artifacts leveraging such compression algorithms in the wild. 71 of the identified samples can be loaded on t...
Microsoft OneNote Spoofing (August 2023)
The Microsoft OneNote Products are missing a security update. It is, therefore, affected by a spoofing vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable Network Security, Inc...
SUSE: Security Advisory (SUSE-SU-2023:3324-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
in-storemedia.com Cross Site Scripting vulnerability OBB-3583007
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
OESA-2023-1504 bouncycastle security update
The package is organised so that it contains a light-weight API suitable for use in any environment including the newly released J2ME with the additional infrastructure to conform the algorithms to the JCE framework. Security Fixes: Bouncy Castle For Java before 1.74 is affected by an LDAP...
Checkmk 2.0.x < 2.0.0p38, 2.1.x < 2.1.0p32, 2.2.x < 2.2.0p4 Command Injection Vulnerability
Checkmk is prone to a command injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:checkmk:checkmk"; if...