CVE-2023-34442 Apache Camel JIRA: Temporary file information disclosure in Camel-Jira

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X through =3.14.8, from 3.18.X through =3.18.7, from 3.20.X through = 3.20.5, from 4.X through = 4.0.0-M3. Users should upgrade to 3.14.9,...

CVE-2023-35887

CVE-2023-35887 affects Apache MINA SSHD when using RootedFileSystem in SFTP servers. The root cause is path traversal outside the rooted tree via paths with '..' or symlinks, allowing logged-in users to discover existence/non-existence of items outside the rooted directory. Affected: Apache MINA ...

CVE-2023-35887 Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the root...

CVE-2023-35887 Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the root...

CVE-2023-3270

CVE-2023-3270 concerns the SICK ICR890-4 track-and-trace system, where an unauthenticated, remote attacker can disclose sensitive information. Affected component: SICK ICR890-4 firmware; root cause centers on exposure of system data to unauthorized actors. Impact is information disclosure; no pub...

CVE-2023-3270

Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system...

CVE-2023-3270

Exposure of Sensitive Information to an Unauthorized Actor in the SICK ICR890-4 could allow an unauthenticated remote attacker to retrieve sensitive information about the system...

Charming Kitten’s Latest Malware Arsenal and Targeting Strategies

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Charming Kitten, an adaptable threat actor, has shifted to new malware tactics and targets by employing LNK infection chains and utilizing cloud hosting providers. This evolution in their approach poses ...

bad actore can increase gas usage in swapfrom function

Lines of code Vulnerability details Impact bad actor can increase gas in swapfrom function because everytime calling swapfrom function it store new unit and everytime runs the loop for length of it Proof of Concept the swapfrom function includes function setReservesIERC20 memory tokens, uint256...

CVE-2023-3553

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10...

Design/Logic Flaw

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10...

CVE-2023-3553 Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10...

CVE-2023-3553 Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10...

Cross site scripting

A Cross-Site Scripting XSS vulnerability found in UniFi Network Version 7.3.83 and earlier allows a malicious actor with Site Administrator credentials to escalate privileges by persuading an Administrator to visit a malicious web page...

The five-day job: A BlackByte ransomware intrusion case study

As ransomware attacks continue to grow in number and sophistication, threat actors can quickly impact business operations if organizations are not well prepared. In a recent investigation by Microsoft Incident Response previously known as Microsoft Detection and Response Team – DART of an...

CVE-2023-35939

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user or not for certain actions, allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8...

Beware: New 'RustBucket' Malware Variant Targeting macOS Users

Researchers have pulled back the curtain on an updated version of an Apple macOS malware called RustBucket that comes with improved capabilities to establish persistence and avoid detection by security software. "This variant of RustBucket, a malware family that targets macOS systems, adds...

Debian dla-3475 : trafficserver - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3475 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3475-1 [email protected]...

The vulnerability of the CORS mechanism implementation in Google Chrome browsers allows a hacker to gain access to confidential data.

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to data leaks from various sources. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data through a specially created HTML page...

Patch me if you can: Cyberattack Series

Many organizations utilize third-party apps for identity security solutions to automate and unburden overtaxed IT admins from tedious tasks that employees can perform via self-service without IT assistance. But in September 2021, our researchers observed threat actors exploiting one such...