The vulnerability of the SatRLT.OS software for programmable logic controllers “Satellite-A” lies in the insecure transmission of authentication data. This allows attackers to escalate their privileges and execute arbitrary code.

The vulnerability of the SatRLT.OS software for programmable logic controllers “Satellite-A” lies in the insecure transmission of authentication data. Exploiting this vulnerability allows a remote attacker to enhance their privileges and execute arbitrary code...

Improved BlackCat Ransomware Strikes with Lightning Speed and Stealthy Tactics

The threat actors behind BlackCat ransomware have come up with an improved variant that prioritizes speed and stealth in an attempt to bypass security guardrails and achieve their goals. The new version, dubbed Sphynx and announced in February 2023, packs a "number of updated capabilities that...

ASB-A-278775990

Bulletin has no description...

ASB-A-271880369

Bulletin has no description...

ASB-A-277775870

Bulletin has no description...

Cisco Identity Services Engine Command Injection Vulnerability (cisco-sa-ise-injection-sRQnsEU9)

According to its self-reported version, Cisco Identity Services Engine is affected by a command injection vulnerability, which could allow an authenticated remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these...

CVE-2023-29078

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in a customer-controlled product. Notes: none...

CVE-2023-25467

Cross-Site Request Forgery CSRF vulnerability in Daniel Mores, A. Huizinga Resize at Upload Plus plugin = 1.3 versions...

CVE-2023-25467

Cross-Site Request Forgery CSRF vulnerability in Daniel Mores, A. Huizinga Resize at Upload Plus plugin = 1.3 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Daniel Mores, A. Huizinga Resize at Upload Plus plugin = 1.3 versions...

CVE-2023-25467

CVE-2023-25467 concerns a CSRF vulnerability in the WordPress plugin Resize at Upload Plus, affecting versions ≤ 1.3. The root cause is a Cross-Site Request Forgery condition that can be triggered by an unauthenticated attacker, potentially compromising actions within the vulnerable plugin. Publi...

UBUNTU-CVE-2023-31669

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote "...

This Week in Spring - May 23rd, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 23rd and, famously, nothing major has happened in the last week OH WAIT WE RELEASED SPRING BOOT 3.1! Have you checked it out yet? It's dope. I did a Spring Tips installment looking at some of its features here that y...

CryptNet A Novel Ransomware-as-a-Service

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary CryptNet is a new ransomware-as-a-service group that employs data exfiltration and .NET code. Currently, it has two victims listed on its data leak site. To receive real-time threat advisories, please...

Meet 'Jack' from Romania! Mastermind Behind Golden Chickens Malware

The identity of the second threat actor behind the Golden Chickens malware has been uncovered courtesy of a "fatal" operational security blunder, cybersecurity firm eSentire said. The individual in question, who lives in Bucharest, Romania, has been given the codename Jack. He is one of the two...

Cisco Small Business Series Switches Buffer Overflow Vulnerabilities (cisco-sa-sg-web-multi-S9g4Nkgv)

Multiple vulnerabilities in the web-based user interface of certain Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to cause a denial of service DoS condition or execute arbitrary code with root privileges on an affected device. These vulnerabilities are due t...

touche-a-tout.ch Cross Site Scripting vulnerability OBB-3348961

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Inside Qilin Ransomware: Affiliates Take Home 85% of Ransom Payouts

Ransomware affiliates associated with the Qilin ransomware-as-a-service RaaS scheme earn anywhere between 80% to 85% of each ransom payment, according to new findings from Group-IB. The cybersecurity firm said it was able to infiltrate the group in March 2023, uncovering details about the...

CVE-2023-21116

In verifyReplacingVersionCode of InstallPackageHelper.java, there is a possible way to downgrade system apps below system image version due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for...

CVE-2023-20930

In pushDynamicShortcut of ShortcutPackage.java, there is a possible way to get the device into a boot loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...