CVE-2023-0922

A vulnerability was found in Samba. This security issue occurs in the Samba AD DC administration tool. When operating against a remote LDAP server, it will, by default, send new or reset passwords over a signed-only connection...

Azure ADを使用するマルチテナント アプリケーションの承認に関する構成ミスの可能性に関するガイダンス

本ブログは、Guidance on Potential Misconfiguration of Authorization of Multi-Tenant Applications that use Azure AD の抄訳版です。最新の情報は原文を参照してください...

SUSE CVE-2023-0922

The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-only connection...

Guidance on Potential Misconfiguration of Authorization of Multi-Tenant Applications that use Azure AD

Summary Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications. The misconfiguration allowed external parties read and write access...

Guidance on Potential Misconfiguration of Authorization of Multi-Tenant Applications that use Azure AD

Summary Summary Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications. The misconfiguration allowed external parties read and writ...

samba -- multiple vulnerabilities

The Samba Team reports: An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this attribute from any object in the directory. The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset...

CVE-2023-0614

The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacker may be able to obtain confidential BitLocker recovery keys from a Samba AD DC...

Bogus Chat GPT extension takes over Facebook accounts

If youre particularly intrigued by the current wave of interest in AI, take care. Theres some bad things lurking in search engine results waiting to compromise your Facebook account. A rogue Chrome extension deployed in a campaign targeting Facebook users is "hitting thousands a day" according to...

Center for Internet Security (CIS) unveils Azure Foundations Benchmark v2.0.0

The Center for Internet Security CIS recently unveiled the latest version of their Azure Foundations Benchmark—Version 2.0.0. This is the first major release since the benchmark was originally released more than 4 years ago, which could lead you to believe that this update would come with a bunch...

Medium: libldb

Issue Overview: A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue is only possible when modifying certain privileged attributes, such as...

Amazon Linux 2023 : ldb-tools, libldb, libldb-devel (ALAS2023-2023-085)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-085 advisory. A flaw was found in the Samba AD LDAP server. The AD DC database audit logging module can access LDAP message values freed by a preceding database module, resulting in a use-after-free issue. This issue...

March 14, 2023—KB5023705 (OS Build 20348.1607)

None None...

Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects

A widespread malicious cyber operation has hijacked thousands of websites aimed at East Asian audiences to redirect visitors to adult-themed content since early September 2022. The ongoing campaign entails injecting malicious JavaScript code to the hacked websites, often connecting to the target...

CVE-2014-125093

A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the file ad-blocking-detector.php. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to...

Information disclosure

A vulnerability has been found in Ad Blocking Detector Plugin up to 1.2.1 on WordPress and classified as problematic. This vulnerability affects unknown code of the file ad-blocking-detector.php. The manipulation leads to information disclosure. The attack can be initiated remotely. Upgrading to...

CVE-2014-125093

CVE-2014-125093 affects WordPress Ad Blocking Detector Plugin versions up to 1.2.1. The vulnerability involves information disclosure due to manipulation in the file ad-blocking-detector.php (unknown code sections). The issue can be triggered remotely. A fix exists: upgrade to version 1.2.2, with...

PT-2023-10161 · Unknown · Ad Blocking Detector Plugin

Name of the Vulnerable Software and Affected Versions: Ad Blocking Detector Plugin versions up to 1.2.1 Description: A vulnerability has been found in the Ad Blocking Detector Plugin, affecting unknown code of the file ad-blocking-detector.php. This issue leads to information disclosure and can b...

DeepStreamer: Illegal movie streaming platforms hide lucrative ad fraud operation

This investigation was a joint effort between Malwarebytes Threat Intelligence's Jerome Segura, DeepSee's Rocky Moss and Antonio Torres. Key findings Over a dozen unique domains were found selling ad inventory through Google Ad Manager, even though the pages were embedded invisibly under the...

SYS01stealer: New Threat Using Facebook Ads to Target Critical Infrastructure Firms

Cybersecurity researchers have discovered a new information stealer dubbed SYS01stealer targeting critical government infrastructure employees, manufacturing companies, and other sectors since November 2022. "The threat actors behind the campaign are targeting Facebook business accounts by using...

The vulnerability of the application for blocking advertisements and Pi-hole internet trackers arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows a violator to execute arbitrary code.

The vulnerability of the Pi-hole ad blocking app exists because measures are not taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...