Fedora 38 : edk2 (2023-ec64a06fe2)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ec64a06fe2 advisory. include latest dbx update may 9th, black lotus edition. Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Notorious Cyber Gang FIN7 Returns With Cl0p Ransomware in New Wave of Attacks

The notorious cybercrime group known as FIN7 has been observed deploying Cl0p aka Clop ransomware, marking the threat actor's first ransomware campaign since late 2021. Microsoft, which detected the activity in April 2023, is tracking the financially motivated actor under its new taxonomy Sangria...

Arbitrary File Read Vulnerability in M7160DW of Zhuhai Pento Printing Technology Co.

The M7160DW is a black-and-white laser MFP that supports printing, copying and scanning functions with USB, wired network, LAN and WIFI connectivity. The M7160DW of Zhuhai Pento Printing Technology Co., Ltd. suffers from an arbitrary file read vulnerability, which can be exploited by an attacker ...

This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide

A cybercrime enterprise known as Lemon Group is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks. "The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages,...

This Cybercrime Syndicate Pre-Infected Over 8.9 Million Android Phones Worldwide

A cybercrime enterprise known as Lemon Group is leveraging millions of pre-infected Android smartphones worldwide to carry out their malicious operations, posing significant supply chain risks. "The infection turns these devices into mobile proxies, tools for stealing and selling SMS messages,...

Lemon Group’s Cybercriminal Businesses Built on Preinfected Devices

An overview of the Lemon Group’s use of preinfected mobile devices, and how this scheme is potentially being developed and expanded to other internet of things IoT devices. This research was presented in full at the Black Hat Asia 2023 Conference in Singapore in May 2023...

New 'MichaelKors' Ransomware-as-a-Service Targeting Linux and VMware ESXi Systems

A new ransomware-as-service RaaS operation called MichaelKors has become the latest file-encrypting malware to target Linux and VMware ESXi systems as of April 2023. The development points to cybercriminal actors increasingly setting their eyes on the ESXi, cybersecurity firm CrowdStrike said in ...

CVE-2023-23863

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin = 2.0.22 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin = 2.0.22 versions...

CVE-2023-23863 WordPress TreePress – Easy Family Trees & Ancestor Profiles Plugin <= 2.0.22 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin = 2.0.22 versions...

CVE-2023-23863 WordPress TreePress – Easy Family Trees & Ancestor Profiles Plugin <= 2.0.22 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Black and White Digital Ltd TreePress – Easy Family Trees & Ancestor Profiles plugin = 2.0.22 versions...

Criminals Are Using Tiny Devices to Hack and Steal Cars

Apple thwarts NSO’s spyware, the rise of a GPT-4 black market, Russia targets Starlink internet connections, and more...

LockBit ransomware on Mac: Should we worry?

One of the big headlines over the weekend is LockBit, the high-profile Russian ransomware gang, decided to expand its portfolio of potential victims by creating and releasing its first macOS payload, potentially triggering members of the Apple community to panic. But have no fear: Apple security...

Design/Logic Flaw

OpenSIPS is a Session Initiation Protocol SIP server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the deletesdpline function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP...

New HiatusRAT Malware Targets Business-Grade Routers to Covertly Spy on Victims

A never-before-seen complex malware is targeting business-grade routers to covertly spy on victims in Latin America, Europe, and North America at least since July 2022. The elusive campaign, dubbed Hiatus by Lumen Black Lotus Labs, has been found to deploy two malicious binaries, a remote access...

Ransomware led to multiple DISH Network outages

Satellite broadcast organisation DISH experienced a major system issue over the past week which affected multiple services. Websites and channels were unavailable, logins were non-functional, and some folks couldnt even pay their bills as a result of the downtime. There was a suspicion that...

Actors, Threats and Vulnerabilities 20 February to 26 February 2023

For a detailed threat digest, download the pdf file here Summary For a detailed threat digest, download the pdf file here HiveForce Labs has identified five active threat actors over the past week. The Earth Kitsune APT and Lazarus Group are North Korean-based cybercrime groups that focus on...

Who’s Behind the Botnet-Based Service BHProxies?

A security firm has discovered that a six-year-old crafty botnet known as Mylobot appears to be powering a residential proxy service called BHProxies, which offers paying customers the ability to route their web traffic anonymously through compromised computers. Heres a closer look at Mylobot, an...

The vulnerability of the server administration interface for managing VMware Carbon Black App Control allows for the injection of arbitrary code, enabling a hacker to execute arbitrary commands.

The vulnerability of the server administration interface for managing VMware Carbon Black App Control relates to the possibility of executing code. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Injection vulnerability in VMware Carbon Black App Control

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary There is an injection vulnerability in VMware, specifically in the Carbon Black App Control product. If a malicious actor, who has privileged access to the App Control administration console,...