VMware Cloud Director Authentication Bypass (VMSA-2023-0026)

VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass log...

CVE-2023-48134

nagayamacopabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2023-48134

nagayamacopabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor...

Information disclosure

nagayamacopabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2023-48134

nagayamacopabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2023-48134

nagayamacopabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor...

Attacks, Vulnerabilities and Actors 6 November to 12 November 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of twenty-five executed attacks, six instances of adversary activity, and four exploited...

CVE-2023-39337

A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious...

Security feature bypass

A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This issue poses a significant security risk, as it enables unauthorized access and potentia...

CVE-2023-39337

A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious...

CVE-2023-39335

A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This issue poses a significant security risk, as it enables unauthorized access and potentia...

CVE-2023-39337

A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious...

CVE-2023-24588

Exposure of sensitive information to an unauthorized actor in firmware for some IntelR OptaneTM SSD products may allow an unauthenticated user to potentially enable information disclosure via physical access...

CVE-2022-46646

Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access...

Information disclosure

Exposure of sensitive information to an unauthorized actor in some IntelR Aptio V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable information disclosure via local access...

Information disclosure

Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access...

Microsoft Releases November 2023 Security Updates

Microsoft has released updates addressing multiple vulnerabilities in Microsoft software. A cyber threat actor can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s November 2023 Security Update Guidelink is...

WordPress WP Rocket 2.10.3 Local File Inclusion Exploit

Paulos Yibelo discovered and reported this Local File Inclusion vulnerability in WordPress WP Rocket Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could...

New Ransomware Group Emerges with Hive's Source Code and Infrastructure

The threat actors behind a new ransomware group called Hunters International have acquired the source code and infrastructure from the now-dismantled Hive operation to kick-start its own efforts in the threat landscape. "It appears that the leadership of the Hive group made the strategic decision...

When the burnToMint function is enabled, any bad actor can transfer the nft-to-burn when it receives the newly minted nft, getting burned after he no longer is the owner.

Lines of code Vulnerability details Impact Medium impact, it affects the functionallity of the nfts with other contracts, as they wouldn't want to interact with tokens that could get burned. Explanation in the NextGenCore contract, the burnToMint function has the minting of the new nft, which mak...