What Gen Z really cares about when it comes to privacy

It would be easy to think that Gen Z doesn’t care about privacy. They worry less about ad tracking, do little to stem the flow of their private information online, and, as Malwarebytes recently uncovered, monitor one another’s lives far more than other generations. But it isn’t that Gen Z,...

p-z-e.de Improper Access Control vulnerability OBB-3770688

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

z-u-m.de Improper Access Control vulnerability OBB-3768734

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: IBM HTTP Server is vulnerable to information disclosure due to the included Apache HTTP Server (CVE-2023-31122)

Summary IBM HTTP Server is vulnerable to information disclosure when using the modmacro module due to the included Apache HTTP Server. Vulnerability Details CVEID:CVE-2023-31122 DESCRIPTION: Apache HTTP Server could allow a remote attacker to obtain sensitive information, caused by an out-of-boun...

SUSE CVE-2023-45667

stbimage is a single file MIT licensed library for processing images. If stbiloadgifmain in stbiloadgiffrommemory fails it returns a null pointer and may keep the z variable uninitialized. In case the caller also sets the flip vertically flag, it continues and calls stbiverticalflipslices with th...

Malicious code in z-dsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e2e8df0358f7f04a5b41981e5e7496d99d985f9e76087b0e3a233566f9ddfd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8393 Malicious code in z-dsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e2e8df0358f7f04a5b41981e5e7496d99d985f9e76087b0e3a233566f9ddfd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IBM DB2 Denial of Service Vulnerability (CNVD-2023-100316)

IBM DB2 is a relational database management system from International Business Machines IBM. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A denial of service vulnerability exists in IBM DB2 version 11.5, which can be exploited by an...

IBM DB2 Denial of Service Vulnerability (CNVD-2023-100315)

IBM DB2 is a relational database management system from International Business Machines IBM. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A denial of service vulnerability exists in IBM DB2 versions 10.5, 11.1, and 11.5, which can be...

IBM DB2 安全漏洞

IBM DB2 is a relational database management system from International Business Machines IBM. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A denial of service vulnerability exists in IBM DB2 version 11.1 and 11.5, which can be exploited ...

AI sneak attacks, location spying, and definitely not malware, or, what one teenager fears online: Lock and Code S04E21

This week on the Lock and Code podcast... What are you most worried about online? And what are you doing to stay safe? Depending on who you are, those could be very different answers, but for teenagers and members of Generation Z, the internet isn't so scary because of traditional threats like...

A week in security (October 2 - October 8)

Last week on Malwarebytes Labs: Multi-factor authentication has proven it works, so what are we waiting for? Amazon Prime email scammer snatches defeat from the jaws of victory 2023 MITRE ATT&CK® Evaluation results: Malwarebytes earns high marks for detection, blocks initial malware executions...

Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]

Summary The Python Cryptographic Authority package is used by the z/TPF real-time insights dashboard starter kit when connecting to a MySQL database from Python. The starter kit was updated to address the vulnerability described by CVE-2023-38325. Vulnerability Details CVEID:CVE-2023-38325...

Security Bulletin: Vulnerabilities in IBM Java Runtime affect z/Transaction Processing Facility

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 8 that is used by the z/TPF system. z/TPF has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-21967 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Editi...

Moderate: Red Hat Security Advisory: Release of containers for OSP 16.2.z (Train) director Operator

Red Hat OpenStack Platform RHOSP 16.2.z Train director Operator containers are now available. Release of Red Hat OpenStack Platform RHOSP 16.2.z Train provides these changes:...

MAL-2023-1504 Malicious code in z-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d1df7db96fadf79c92ca77b7fd6e95a23c25f7d4c1f7507b4316730a4086d1dc The OpenSSF Package Analysis project identified 'z-foundation' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in z-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d1df7db96fadf79c92ca77b7fd6e95a23c25f7d4c1f7507b4316730a4086d1dc The OpenSSF Package Analysis project identified 'z-foundation' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

z-m Cross Site Scripting vulnerability OBB-3570558

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

IBM DB2 is a relational database management system from International Business Machines (IBM). The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A denial of service vulnerability exists in IBM Db2, which can be exploited by an attacker to cause a denial of service.

CasaOS is a simple, easy-to-use and elegant open source home cloud system. An Access Control Error vulnerability exists in CasaOS versions prior to 0.4.4 that stems from a lack of authenticated IP addresses. An attacker can exploit the vulnerability to execute arbitrary commands as root...

IBM DB2 Stack Buffer Overflow Vulnerability

IBM DB2 is a relational database management system from International Business Machines IBM. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. IBM DB2 suffers from a stack buffer overflow vulnerability that stems from incorrect boundary...