exempi 缓冲区错误漏洞

exempi is an open source XMP library from libopenraw. A security vulnerability exists in exempi version 2.5.0 and earlier versions, which stems from a buffer overflow vulnerability in WEBPSupport.cpp...

Update from 12.1 to 13.x getting Cannot Complete Request / gateway plug-in for java is not supported

When upgrading from version 12.1 to 13.0 and get "Cannot complete request" through NetScaler...

CVE-2020-18651

Buffer Overflow vulnerability in function ID3Support::ID3v2Frame::getFrameValue in exempi 2.5.0 and earlier allows remote attackers to cause a denial of service via opening of crafted audio file with ID3V2 frame...

The vulnerability in web browsers Firefox ESR, Firefox, and the email client Thunderbird involves the concealment of important security information. This allows attackers to gain access to confidential data, compromise its integrity, and cause service interruptions.

The vulnerabilities in web browsers Firefox ESR, Firefox, and the email client Thunderbird involve the concealment of important security-related information. Exploiting these vulnerabilities can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause servi...

Malicious code in postman-zendesk-support-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3501f72f7b7c1700a90f7ad5e3a55cd2462c210637c68dc75f9d336e9bf0063 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WoofLocker Toolkit Hides Malicious Codes in Images to Run Tech Support Scams

Cybersecurity researchers have detailed an updated version of an advanced fingerprinting and redirection toolkit called WoofLocker that's engineered to conduct tech support scams. The sophisticated traffic redirection scheme was first documented by Malwarebytes in January 2020, leveraging...

Attackers demand ransoms for stolen LinkedIn accounts

An ongoing campaign targeting LinkedIn accounts has led to victims losing control of their accounts, or being locked out following repeated login attempts. Whether the attackers are using brute force methods or credential stuffing isn't known, but because some victims are being being locked out...

Metasploit Weekly Wrap-Up

Meterpreter Testing This week’s release adds new payload tests to our automated test suite. This is intended to help the team and community members identify issues and behavior discrepancies before changes are made. Payloads run on a variety of different platforms including Windows, Linux, and OS...

The vulnerability of the application for obtaining Intel Support information for Android, related to the improper use of standard permissions, allows a perpetrator to gain unauthorized access to information.

The vulnerability of the Intel Support product information application for Android relates to the improper use of standard permissions. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to information...

The vulnerability of the application for obtaining Intel Support information for Android, related to the improper use of standard permissions, allows a perpetrator to gain unauthorized access to information.

The vulnerability of the application for obtaining Intel Support information for Android relates to the improper use of standard permissions. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to information...

Part III: Implementing Effective Cyber Security Metrics that Reduce Risk Realistically

We outlined some critical cybersecurity metrics in Part I of this three-part blog series. In the final blog post, we will delve into three crucial aspects outlined in Josh’s article: tactical metrics for operational teams, strategic metrics for leadership, and the metrics addressing the...

Catching up with WoofLocker, the most elaborate traffic redirection scheme to tech support scams

Back in January 2020, we blogged about a tech support scam campaign dubbed WoofLocker that was by far using the most complex traffic redirection scheme we had ever seen. In fact, the threat actor had started deploying infrastructure in earnest as early as 2017, about 3 years prior to our...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Arbitrary File Upload

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-25444 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 334d985d1f7d Credits Abdi Prana...

Cisco Umbrella Virtual Appliance Undocumented Support Tunnel Vulnerability

A vulnerability in the remote support feature of Cisco Umbrella Virtual Appliance could allow an authenticated, remote attacker to obtain full control of an affected device. This vulnerability is due to an undocumented support mechanism that is present on the product. An attacker could exploit th...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.13 security update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Eliminate Advanced Endpoint Analysis scans on Mobile devices/iOS.

We have a pre-epa + ldap as the authentication method. Since we have EPA as pre-authentication when we try to access via the mobile devices such as Android/iPhone or iOS and other devices we won’t be able to access. As we know that EPA scan is not supported on mobile devices or iOS, therefore we...

Privilege escalation

The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operating system. IBM X-Force ID: 262173...

HackerOne: Support Tickets can be created on behalf of other users using spoofed email | Bypass of #2001913

A vulnerability allowed an attacker to create support tickets on behalf of other users by sending a fake email to [email protected]. This bypassed a previous fix implemented by HackerOne to prevent support tickets from being created via email...

CVE-2023-38721 IBM i privilege escalation

The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operating system. IBM X-Force ID: 262173...

CVE-2023-38721

The CVE-2023-38721 vulnerability affects IBM i Facsimile Support for i on IBM i versions 7.2–7.5. The issue is a local privilege escalation that could let an attacker obtain a command line with root-level access to the host OS. Remediation is available via IBM i PTF SI84228 for all affected relea...