DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability

A newly disclosed security flaw in the Microsoft Defender SmartScreen has been exploited as a zero-day by an advanced persistent threat actor called Water Hydra aka DarkCasino targeting financial market traders. Trend Micro, which began tracking the campaign in late December 2023, said it entails...

PT-2023-12817 · Qualcomm · 9205 Lte Modem Firmware +7

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned Description: The issue is related to memory corruption in a modem, caused by improper input validation when handling incoming CoAP messages. Recommendations: At the moment, there is no information...

PT-2023-13238 · Qualcomm · 9205 Lte Modem Firmware +18

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue is related to memory corruption in a modem. This occurs due to an improper check while calculating the size of a serialized CoAP message, leading to potential exploitation...

PT-2023-12795 · Qualcomm · Snapdragon +181

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption in a modem due to an integer overflow leading to a buffer overflow when handling APDU responses. This occurs while...

SUSE CVE-2011-0687

Opera before 11.01 does not properly implement Wireless Application Protocol WAP dropdown lists, which allows user-assisted remote attackers to cause a denial of service application crash via a crafted WAP document...

SUSE CVE-2016-6512

epan/dissectors/packet-wap.c in Wireshark 2.x before 2.0.5 omits an overflow check in the tvbgetguintvar function, which allows remote attackers to cause a denial of service infinite loop via a crafted packet, related to the MMSE, WAP, WBXML, and WSP dissectors...

Design/Logic Flaw

Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttling, causing the threshold to be reached...

CVE-2022-1319

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second...

DEBIAN-CVE-2022-2053

When a POST request comes through AJP and the request exceeds the max-post-size limit maxEntitySize, Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker...

Toll fraud malware: How an Android application can drain your wallet

Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...

Toll fraud malware: How an Android application can drain your wallet

Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve. Compared to other subcategories of billing fraud, which...

CVE-2021-41040

In Eclipse Wakaama, ever since its inception until 2021-01-14, the CoAP parsing code does not properly sanitize network-received data...

Eclipse Wakaama 缓冲区错误漏洞

Eclipse Wakaama is a C-based, open source implementation of the OMA LWM2M protocol from the Eclipse Foundation. A buffer error vulnerability exists in Eclipse Wakaama versions 2021-01-14 and earlier, which stems from the CoAP parsing code failing to properly clean up data received over the networ...

PT-2022-11359 · Eclipse · Eclipse Wakaama

Name of the Vulnerable Software and Affected Versions: Eclipse Wakaama versions prior to 2021-01-14 Description: The issue arises from the CoAP parsing code in Eclipse Wakaama, which fails to properly sanitize network-received data. This has been the case since the inception of Eclipse Wakaama...

Hitachi Energy Relion 输入验证错误漏洞

Hitachi Energy Relion is a power system for protection, control, measurement and monitoring from Hitachi Energy, Switzerland. A security vulnerability exists in the Hitachi Energy RTU500 series that stems from incorrect input validation in the APDU parser in the IEC 60870-5-104 function...

CVE-2020-3430

A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this...

Design/Logic Flaw

A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this...

CVE-2020-3430: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this...

CVE-2020-12884

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparsemultipleoptions parses CoAP options that may occur multiple consecutive times in a single packet. While processing th...

Zephyr Input Validation Error Vulnerability (CNVD-2020-35963)

Zephyr is an open source, small, scalable real-time operating system from the Linux Foundation. An input validation error vulnerability exists in Zephyr version 2.2.0 and later fixed in version 2.3.0. An attacker can exploit this vulnerability to cause a denial of service with arbitrary CoAP...