14663 matches found
CryptosLabs Scam Ring Targets French-Speaking Investors, Rakes in €480 Million
Cybersecurity researchers have exposed the workings of a scam ring called CryptosLabs that's estimated to have made €480 million in illegal profits by targeting users in French-speaking individuals in France, Belgium, and Luxembourg since April 2018. The syndicate's massive fake investment scheme...
CryptosLabs Scam Ring Targets French-Speaking Investors, Rakes in €480 Million
Cybersecurity researchers have exposed the workings of a scam ring called CryptosLabs that's estimated to have made €480 million in illegal profits by targeting users in French-speaking individuals in France, Belgium, and Luxembourg since April 2018. The syndicate's massive fake investment scheme...
Stalkerware Vendor Hacked
The stalkerware company LetMeSpy has been hacked: TechCrunch reviewed the leaked data, which included years of victims call logs and text messages dating back to 2013. The database we reviewed contained current records on at least 13,000 compromised devices, though some of the devices shared litt...
Google Pixel 缓冲区错误漏洞
Google Pixel is a smartphone from Google, Inc. in the United States. A security vulnerability exists in Google Pixel, which stems from the presence of a missing bounds check in the DoAIMSSETCALLWAITING of the imsservice.cpp file, which may result in an out-of-bounds read...
PT-2023-17946 · Google · Android Kernel
Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds read in the Do AIMS SET CALL WAITING function of imsservice.cpp due to a missing bounds check. This could lead to local escalation of privilege, requiring System...
CVE-2023-34422
A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation...
CVE-2023-34421
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation...
CVE-2023-34420
A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API...
CVE-2023-34421
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation...
CVE-2023-34421
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation...
Lenovo XClarity Administrator 操作系统命令注入漏洞
Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The product is capable of providing agentless hardware management for servers, storage, network switches, and more. A command injection vulnerability exists in Lenovo XClarity Administrator, which...
PT-2023-24868 · Lenovo · Lenovo Xclarity Administrator
Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator LXCA affected versions not specified Description: The issue allows a valid, authenticated LXCA user with elevated privileges to potentially replace filesystem data through a specifically crafted web API call due ...
PT-2023-24869 · Lenovo · Lxca
Name of the Vulnerable Software and Affected Versions: LXCA affected versions not specified Description: A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation...
The vulnerability affects the runtime of procedure calls in the Windows operating system, allowing an attacker to cause a service failure.
The vulnerability of remote procedure call runtime in the Windows operating system stems from insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...
GHSA-CH48-9R3Q-PV7X Vaadin vulnerable to possible information disclosure of class and method names in RPC response
Description Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests...
CVE-2023-20896
The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services...
CVE-2023-20895
The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication...
Vaadin 信息泄露漏洞
Vaadin is an open source platform for web application development from Vaadin Open Source.The Vaadin platform includes a set of web components, a Java web framework, and a set of tools and application launchers. A security vulnerability exists in Vaadin that stems from a potential information...
tryCatchLimit can forward less than the specified gasLimit due to how CALL* opcode forward gas
Lines of code Vulnerability details Description To understand the issue I strongly recommend the lecture of this article. In particular, sections "Insufficient Gas Griefing Attack" and "Workaround Against “Insuficient Gas Griefing attack”". The problem relays on the fact that we cannot be sure th...