447 matches found
Inside the Massive Crime Industry That’s Hacking Billion-Dollar Companies
When you download a piece of pirated software, you might also be getting a piece of infostealer malware, and entering a highly complex hacking ecosystem that’s fueling some of the biggest breaches on the planet...
Two of Wallarm’s Open-source Tools Have Been Accepted into Black Hat Arsenal 2024
We're gearing up with some seriously cool stuff for Black Hat! But first, a little sneak peek - not just one, but TWO of Wallarm's open-source tools will be featured in the Arsenal showcase at Black Hat USA this year. Black Hat Arsenal unites researchers and the open-source community to display...
CVE-2022-28652
/.config/apport/settings parsing is vulnerable to "billion laughs" attack...
CVE-2022-28652
/.config/apport/settings parsing is vulnerable to "billion laughs" attack...
CVE-2022-28652
/.config/apport/settings parsing is vulnerable to "billion laughs" attack...
CVE-2022-28652
/.config/apport/settings parsing is vulnerable to "billion laughs" attack...
GHSA-Q2GC-GG3X-7942 Symfony XML Entity Expansion security vulnerability
Symfony 2.0.11 carried a similar XXE security fix, however, on review of ZF2 I also noted a vulnerability to XML Entity Expansion XEE attacks whereby all extensions making use of libxml2 have no defense against XEE Quadratic Blowup Attacks. The vulnerability is a function of there being no curren...
Breakthrough for Solv Protocol: $1 Billion TVL, Now a Top 32 DeFi Player
By Uzair Amir New York City, May 22 – Solv Protocol, a unified yield and liquidity layer for major digital assets,… This is a post from HackRead.com Read the original post: Breakthrough for Solv Protocol: $1 Billion TVL, Now a Top 32 DeFi Player...
CVE-2024-1455 Billion Laughs Attack leading to DoS in langchain-ai/langchain
A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...
CVE-2024-1455 Billion Laughs Attack leading to DoS in langchain-ai/langchain
A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity XXE exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML parser to consume excessive CPU and memory resources, leading t...
PT-2024-18059
Name of the Vulnerable Software and Affected Versions LangChain affected versions not specified Description The issue concerns the XMLOutputParser in LangChain, which utilizes the etree module from the XML parser in the standard Python library. This library has some XML vulnerabilities, making it...
[slackware-security] expat
New expat packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/expat-2.6.2-i586-1slack15.0.txz: Upgraded. Prevent billion laughs attacks with isolated use of external parsers. For more information,...
[slackware-security] expat
New expat packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/expat-2.6.0-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fix quadratic runtime issues with big tokens that can cau...
Ransomware Payments Hit a Record $1.1 Billion in 2023
After a slowdown in payments to ransomware gangs in 2022, last year saw total ransom payouts jump to their highest level yet, according to a new report from crypto-tracing firm Chainalysis...
This Week in Spring - January 23rd, 2024
Hi, Spring fans, and greetings from CERN, home of the famous Large Hadron Collider, where I'm speaking again at the VOXXED Days CERN 2017 event. It's been an amazing almost week here in lovely Switzerland, first in Lugano for VOXXED Days Ticino, and now in Geneva. I'm super excited to be here, bu...
Cryptocurrency losses reach $1.75 Billion in 2023; CeFi and Hacks Blamed
By Waqas November 2023 has emerged as the most devastating year for crypto users and the most lucrative for cybercriminals and malicious hackers, as the majority of crypto hacks occurred during that month. This is a post from HackRead.com Read the original post: Cryptocurrency losses reach $1.75...
Denial Of Service (DoS)
github.com/go-jose/go-jose is vulnerable to Billion Hashes Attack. The vulnerability is due to the decryptKey function in symmetric.go because it only checks if the value of p2c is a positive integer, but lacks a maximum size check. This allow an attacker to provide a PBES2 encrypted JWE blob wit...
GHSA-2C7C-3MJ9-8FQH Decryption of malicious PBES2 JWE objects can consume unbounded system resources
The go-jose package is subject to a "billion hashes attack" causing denial-of-service when decrypting JWE inputs. This occurs when an attacker can provide a PBES2 encrypted JWE blob with a very large p2c value that, when decrypted, produces a denial-of-service...
Denial Of Service (DoS)
remarshal is vulnerable to Denial Of Service DoS. The vulnerability exists because remarshal.py does not properly limit the maximum nodes to be expanded. This allows YAML alias nodes to be expanded indefinitely when processing untrusted YAML files. Consequently, an attacker could exploit this...
GHSA-GW7G-QR8W-3448 Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack
Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service DoS condition...