14447 matches found
JTEKT TOYOPUC
1. EXECUTIVE SUMMARY CVSS v3 7.7 ATTENTION: Exploitable remotely Vendor: JTEKT Equipment: TOYOPUC Products Vulnerability: Missing Authentication for Critical Function CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology OT...
Phoenix Contact Classic Line Controllers
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Phoenix Contact Equipment: ILC, AXC, RFC, PC WORX, FC Vulnerability: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...
Malicious code in arm-analysisservices (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc2c12b4362b2b6780a4dcd414f78e809781b978562c2d6fce1ddf246d6ee864 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Infiray IRAY-A8Z3 1.0.957 Code Execution / Overflow / Hardcoded Credentials
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities product: Infiray IRAY-A8Z3 thermal camera vulnerable version: V1.0.957 fixed version: None CVE number: CVE-2022-31208, CVE-2022-31209,...
LambdaGuard - AWS Serverless Security
AWS Lambda is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code. LambdaGuard is an AWS Lambda auditing tool designed to create asset...
GHSA-GFG9-X6PX-R7GR Library exclusively intended to obfuscate code.
This crate allows you to write safe functions with unsafe bodies without the unsafe keyword. The value this adds is questionable, and hides unsafe usages from naive analysis...
Library exclusively intended to obfuscate code.
This crate allows you to write safe functions with unsafe bodies without the unsafe keyword. The value this adds is questionable, and hides unsafe usages from naive analysis...
Hertzbleed exposes computers’ secret whispers
Hertzbleed is the name for a vulnerability that can be used to obtain cryptographic keys and other secret data from Intel and AMD CPUs, remotely. It works by monitoring changes in power consumption, which can be deduced by the careful timing of known workloads, thanks to a processor power saving...
New Hertzbleed Side Channel Attack Affects All Modern AMD and Intel CPUs
A newly discovered security vulnerability in modern Intel and AMD processors could let remote attackers steal encryption keys via a power side channel attack. Dubbed Hertzbleed by a group of researchers from the University of Texas, the University of Illinois Urbana-Champaign, and the University ...
Ransomware Group Debuts Searchable Victim Data
Cybercrime groups that specialize in stealing corporate data and demanding a ransom not to publish it have tried countless approaches to shaming their victims into paying. The latest innovation in ratcheting up the heat comes from the ALPHV/BlackCat ransomware group, which has traditionally...
block.timestamp as time proxy
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. 1. block.timestamp used as time proxy a. Summary: Risk of using block.timestamp for time should be considered. b. Details: block.timestamp is not an ideal proxy for time because of issues with...
Posible UUPSUpgradeable attack
Lines of code Vulnerability details Impact Missing implementation of the modifier Summary: initializer modifier is found in wfCashBase.sol but none of the OZ Initializable or AAVETokenV2Mintable.sol are included in wfCashBase or any of its related files. Details: I couldn’t find the modifier to b...
CVE-2022-32741
Attacker is able to determine if the provided username exists and it's valid using Request New Password feature, based on the response time...
Upgraded Q -> H from 45 [1655007594160]
Judge has assessed an item in Issue 45 as High risk. The relevant finding follows: Impact The CoreCollection initialize function is missing the onlyUnInitialized function. The onlyUnInitialized modifier is not used in the contract right now and this allows the initialize function to be called mor...
Exploit for CVE-2022-30190
Follina MS-MSDT exploitation with Spring Boot This repository...
Researchers Warn of Spam Campaign Targeting Victims with SVCReady Malware
A new wave of phishing campaigns has been observed spreading a previously documented malware called SVCReady. "The malware is notable for the unusual way it is delivered to target PCs — using shellcode hidden in the properties of Microsoft Office documents," Patrick Schläpfer, a threat analyst at...
A new vision for cloud security unites builders and defenders
Our introduction of attack path analysis APA and Cloud Detection and Response CDR further enriches the context provided by our foundational Wiz Security Graph...
AWS-Threat-Simulation-and-Detection - Playing Around With Stratus Red Team (Cloud Attack Simulation Tool) And SumoLogic
This repository is a documentation of my adventures with Stratus Red Team - a tool for adversary emulation for the cloud. Stratus Red Team is "Atomic Red Team for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained manner. We run the attacks covered in the...
The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows allows a hacker to perform spoofing attacks due to improper data analysis of XML messages in XMPP messages.
The vulnerability of clients for conducting real-time audio and video conferences using Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows is related to improper analysis of XML data in XMPP messages. Exploiting this vulnerability allows a malicious actor to perform a spoofing...