Exploit for Improper Input Validation in Microsoft

CVE-2024-21413 - Expect Script POC Microsoft Outlook Leak cre...

CVE-2024-25617

A flaw was found in Squid. This issue may allow a remote client or remote server to trigger a denial of service when sending oversized headers in HTTP messages. Mitigation To mitigate this flaw in Squid versions prior to 6.5, set the requestheadermaxsize and replyheadermaxsize configuration optio...

A week in security (February 5 – February 11)

Last week on Malwarebytes Labs: Ivanti urges customers to patch yet another critical vulnerability Ransomware in 2023 recap: 5 key takeaways FBI and CISA publish guide to Living off the Land techniques Warning from LastPass as fake app found on Apple App Store 2 million job seekers targeted by da...

PT-2024-7734 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel version 6.8.0-rc3 Description: The issue is related to a potential buffer overflow in the fscanf function, which may occur when the mount point variable is used. The warning is reported by clang, indicating that the destination...

Warning from LastPass as fake app found on Apple App Store

Password Manager LastPass has warned about a fraudulent app called “LassPass Password Manager” which it found on the Apple App Store. The app closely mimics the branding and appearance of LastPass, right down to the interface. So, even if the name was a “happy accident” it seems clear that this w...

A week in security (January 29 – February 4)

Last week on Malwarebytes Labs: CISA: Disconnect vulnerable Ivanti products TODAY FBI removes malware from hundreds of routers across the US "You have blood on your hands." Senate Committee calls for action by social media giants to protect children online Tax season is here, so are scammers Moth...

New ZLoader Malware Variant Surfaces with 64-bit Windows Compatibility

Threat hunters have identified a new campaign that delivers the ZLoader malware, resurfacing nearly two years after the botnet's infrastructure was dismantled in April 2022. A new variant of the malware is said to have been in development since September 2023, Zscaler ThreatLabz said in an analys...

MAL-2024-741 Malicious code in wlwz-2312-6304 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6ce8d72afc4c30e965d4fd324307fffbf59f6a993a75245861f2f876589939f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-647 Malicious code in wlwz-2312-5300 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50fca67107983106693c8958b74438ad0353ca8e3ba131b4ab590d176f666bda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-360 Malicious code in wlwz-2312-2101 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37bd31b1ef04918702ea9c441062375890a29f9c8934330f534d23bc3f1acd50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-228 Malicious code in wlwz-2312-0604 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ad1fbd0f24939513ab22226e41c6de9cd2b9cdd56c550df75ee5140c1c21db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-356 Malicious code in wlwz-2312-2006 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca4724585c0c1a8632b57143b8fe6f1eb48784621159964ce9f3536c9dc72af6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-296 Malicious code in wlwz-2312-1400 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25467d90d98e89ea4bae91203eef4b062209423919e0015c11cd88fd544ed43d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Google changes wording for Incognito browsing in Chrome

Users of Chrome Canary have noticed some slight changes in the wording that Google uses for Incognito mode. Chrome Canary is mainly intended for use by developers. It’s updated nearly daily with new features, and because it can be used alongside versions of the “normal” Chrome browser known...

Exploit for Path Traversal in Saltstack Salt

CVE-2020-11652-CVE-2020-11652-POC This is a fix POC CVE-2020-...

A true tale of virtual kidnapping: Lock and Code S05E02

This week on the Lock and Code podcast… On Thursday, December 28, at 8:30 pm in the Utah town of Riverdale, the city police began investigating what they believed was a kidnapping. 17-year-old foreign exchange student Kai Zhuang was missing, and according to Riverdale Police Chief Casey Warren,...

Apache OpenOffice < 4.1.15 Multiple Vulnerabilities (macOS)

The version of Apache OpenOffice installed on the remote host is a version prior to 4.1.15. It is, therefore, affected by multiple vulnerabilities as stated in the vendor advisories and release notes. - Apache OpenOffice documents can contain links that call internal macros with arbitrary...

GitLab 13.1 < 13.12.9 / 14.0 < 14.0.7 / 14.1 < 14.1.2 (CVE-2021-22244)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability data CVE-2021-22244 Note that Nessus has not tested...

ActiveAdmin CSV Injection leading to sensitive information disclosure

Impact In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet formulas could be uploaded as part of admin data that, when exported to a CSV file and the imported to a spreadsheet program like libreoffice, could lead to remote code execution and private data exfiltration. The...

The vulnerability of Mozilla Firefox and Firefox Focus lies in the lack of a warning when switching to a new handler, allowing attackers to exploit it to compromise data integrity.

The vulnerability of Mozilla Firefox and Firefox Focus is related to the lack of a warning when switching to a new protocol handler. Exploiting this vulnerability allows a remote attacker to compromise data integrity...