This Week in Spring - Spring Boot 3.2 edition - November 21st, 2023

Hi, Spring fans! Welcome to another epic installment of This Week in Spring! As amazing as the week's already been, it's all leading up to this Thursday - Thanksgiving day! - when we release Spring Boot 3.2! and yes, I am very grateful. This release is stuffed to the gills with a ton of new...

CVE-2023-48025

Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned getlengthlispcellt x at eval.c...

MAL-2023-8525 Malicious code in schibsted-ufo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a28167ab8729dd1bbb8263b5862e431e6df15135343db190e75aab652e104eea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-44336

Adobe Acrobat Reader versions 23.006.20360 and earlier and 20.005.30524 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a...

zell57.at Improper Access Control vulnerability OBB-3782169

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

schmidtschlaegerhoch2.at Improper Access Control vulnerability OBB-3781363

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

room66.at Improper Access Control vulnerability OBB-3781345

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

gdi2050.at Improper Access Control vulnerability OBB-3779813

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ff122.at Improper Access Control vulnerability OBB-3779758

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

braungasse41.at Improper Access Control vulnerability OBB-3779554

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Decoupling for Security

This is an excerpt from a longer paper. You can read the whole thing complete with sidebars and illustrations here. Our message is simple: it is possible to get the best of both worlds. We can and should get the benefits of the cloud while taking security back into our own hands. Here we outline ...

MAL-2023-8480 Malicious code in shithandler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d2d2f23f11e1a03fe9bbad28d2afea9ac0fabd63c4abfd437521e715fcfd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Metasploit Weekly Wrap-Up

PTT for DCSync This week, community member smashery made an improvement to the windowssecretsdump module to enable it to dump domain hashes using the DCSync method after having authenticated with a Kerberos ticket. Now, if a user has a valid Kerberos ticket for a privileged account, they can run...

MAL-2023-8410 Malicious code in discordstream (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3801c3a70b5c9331598f373a5ca452e1121433f365c2b75d35db99042e4b995 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-26941

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the tedsapp...

CVE-2022-26941

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the tedsapp...

Format string

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the tedsapp...

CVE-2022-26941

CVE-2022-26941 affects Motorola MTM5000 series firmware; the AT+CTGL command handler contains a format-string vulnerability where an attacker-controlled string can be misinterpreted, enabling a write-anything-anywhere condition and arbitrary code execution inside the teds_app binary that runs wit...

CVE-2022-26941 Format string vulnerability in AT+CTGL command in Motorola MTM5000

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the tedsapp...

CVE-2022-26941 Format string vulnerability in AT+CTGL command in Motorola MTM5000

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the tedsapp...