CVE-2023-22475 Cross-Site Scripting in Canarytoken history

Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens prior to sha-fb61290. An attacker who discovers an HTTP-based Canarytoken a URL can use this to execute...

CVE-2023-22475

CVE-2023-22475 affects Canarytokens. The issue is a Cross-Site Scripting vulnerability in the history page of triggered Canarytokens prior to sha-fb61290, allowing an attacker who discovers an HTTP-based Canarytoken URL to execute JavaScript when the history page is viewed by the token’s creator....

Thinkst Canarytokens 跨站脚本漏洞

Thinkst Canarytokens is a web activity tracking system. Thinkst Canarytokens suffers from a cross-site scripting vulnerability that stems from the history page of the canarytoken it triggers allowing an attacker to implement cross-site scripting...

Google to Pay $29.5 Million to Settle Lawsuits Over User Location Tracking

Google has agreed to pay a total of $29.5 million to settle two different lawsuits brought by Indiana and Washington, D.C., over its "deceptive" location tracking practices. The search and advertising giant is required to pay $9.5 million to D.C. and $20 million to Indiana after the states sued t...

PT-2025-54001

Name of the Vulnerable Software and Affected Versions linux affected versions not specified Description A flaw exists in the Linux kernel related to Indirect Branch Tracking IBT on x86/Hyperv systems. Specifically, when running on hardware supporting IBT within Hyper-V VMs with ConfigVersion 9.3 ...

CVE-2021-23119

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...

GHSA-9H6H-9G78-86F7 Yapscan's report receiver server vulnerable to path traversal and log injection

Impact If you make use of the report receiver server experimental, a client may be able to forge requests such that arbitrary files on the host can be overwritten subject to permissions of the yapscan server, leading to loss of data. This is particularly problematic if you do not authenticate...

Go-Yaml 安全漏洞

Go-Yaml is a Yaml support for the Go language. It enables Go programs to easily encode and decode Yaml values. A security vulnerability exists in Go-Yaml that stems from unrestricted alias tracking, where a maliciously crafted YAML file may cause the system to consume large amounts of system...

KmsdBot Botnet Suspected of Being Used as DDoS-for-Hire Service

An ongoing analysis of the KmsdBot botnet has raised the possibility that it's a DDoS-for-hire service offered to other threat actors. This is based on the different industries and geographies that were attacked, web infrastructure company Akamai said. Among the notable targets included FiveM and...

Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities

Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-exploitation activities. Mandiant, which discovered the "socially engineered supply chain" attack around mid-July 2022, said the malicious I...

SUSE-SU-2022:4428-1 Security update for grafana

This update for grafana fixes the following issues: Version update from 8.3.10 to 8.5.13 jscPED-2145: - Security fixes: CVE-2022-36062: bsc1203596 CVE-2022-35957: bsc1203597 CVE-2022-31107: bsc1201539 CVE-2022-31097: bsc1201535 CVE-2022-29170: bsc1199810 CVE-2021-43813, CVE-2021-43815: bsc1193686...

LPDA.sol and FixedPrice.sol will lock the funds forever

Lines of code Vulnerability details Impact Possibility of IDs collision The ether will be locked on FixedPrice or LPDA Proof of Concept On the same Escher721 Let’s say the first collection start from id = 0 and end on id = 10 So the next collection of the same Escher721 We can say the next part o...

Apple's AirTag stalker safeguards are "woefully inadequate," alleges lawsuit

Two women filed a proposed class-action lawsuit on Monday, December 5, in the United States District Court for the Northern District of California against Apple, the makers of AirTags. Airtags are a small Bluetooth-enabled devices designed to track personal belongings. The suit accuses the compan...

USN-5756-2 linux-gke vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

USN-5758-1: Linux kernel vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

USN-5757-1: Linux kernel vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

USN-5756-1 linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

A new strain of Punisher ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new variant of the Punisher ransomware is spreading via phishing website that delivers ransomware disguised as a COVID tracking application. Punisher Encryptor is a .NET binary that runs on Windows...

USN-5728-3: Linux kernel (GCP) vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

Fake COVID-19 Tracking App Spreads Punisher Ransomware

By Deeba Ahmed Currently, the new campaign involving Punisher ransomware is targeting users in Chile. This is a post from HackRead.com Read the original post: Fake COVID-19 Tracking App Spreads Punisher Ransomware...