Veeam Backup for Cloud Solutions Potential Data Loss

Challenge Possible data loss in backups created. Affected product versions: Veeam Backup for AWS 5.0.0.452 Veeam Backup for AWS 5.1.0.39 Veeam Backup for Microsoft Azure 4.0.0.679 Veeam Backup for Google Cloud 3.0.0.859 Cause While creating backups to object storage, data loss may occur within th...

CVE-2022-46831

In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators...

CVE-2022-46831

JetBrains TeamCity versions 2022.10–2022.10.1 are affected by CVE-2022-46831 due to a flaw when connecting to AWS with the Default Credential Provider Chain, allowing TeamCity project administrators to access AWS resources normally restricted to TeamCity system administrators. Impact is exposure ...

DeFiChain’s Grand Central Hard Fork Is Now LIVE

By Deeba Ahmed It is time to welcome a brand-new token consortium and on-chain governance framework, Grand Central hard fork, to… This is a post from HackRead.com Read the original post: DeFiChain’s Grand Central Hard Fork Is Now LIVE...

curl: HTTP compression denial of service

A vulnerability was found in curl. This issue occurs because the number of acceptable "links" in the "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps. This flaw leads to a denial of service, either by mistake or by a...

curl: HTTP compression denial of service

A vulnerability was found in curl. This issue occurs because the number of acceptable "links" in the "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps. This flaw leads to a denial of service, either by mistake or by a...

Iranian Hackers Strike Diamond Industry with Data-Wiping Malware in Supply-Chain Attack

An Iranian advanced persistent threat APT actor known as Agrius has been attributed as behind a set of data wiper attacks aimed at diamond industries in South Africa, Israel, and Hong Kong. The wiper, referred to as Fantasy by ESET, is believed to have been delivered via a supply-chain attack...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A security vulnerability exists in JetBrains TeamCity...

PT-2022-27989 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions 2022.10 through 2022.10.1 Description: The issue allows TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators when connecting to AWS using the "Default Credentia...

White Label CMS < 2.5 - Admin+ PHP Object Injection

The plugin unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. PoC To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup : void...

White Label CMS < 2.5 - Admin+ PHP Object Injection

The plugin unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. To simulate a gadget chain, put the following code in a plugin: class Evil public function wakeup : void...

PT-2022-26894 · Unknown · Csliuwy Coder-Chain Gdut

Name of the Vulnerable Software and Affected Versions: csliuwy coder-chain gdut affected versions not specified Description: A vulnerability has been found in csliuwy coder-chain gdut, classified as problematic. It affects an unknown functionality of the file "/back/index.php/user/User/?1". The...

New BMC Supply Chain Vulnerabilities Affect Servers from Dozens of Manufacturers

Three different security flaws have been disclosed in American Megatrends AMI MegaRAC Baseboard Management Controller BMC software that could lead to remote code execution on vulnerable servers. "The impact of exploiting these vulnerabilities include remote control of compromised servers, remote...

Relayer/executor-already-set Error in CrossChainRelayerArbitrum Contract

Lines of code Vulnerability details Summary The setExecutor function in the CrossChainRelayerArbitrum contract improperly reverts when the executor variable has already been set. Impact This bug could prevent the CrossChainRelayerArbitrum contract from properly setting the executor variable,...

Stop Spammers Security < 2022.6 - Unauthenticated PHP Object Injection

The plugin passes base64 encoded user input to the unserialize PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain PoC To simulate a gadget chain, put the following code in a plugin class Ev...

Missing msg.value when executing the cross-chain request

Lines of code Vulnerability details Impact the cross-chain request will not support smart contract that requires ETH payment in destination chain on execution side. Proof of Concept When a user relayers call and performs a cross-chain request, the executor needs to execute the request in the...

Cross-chain request does not have expiration time

Lines of code Vulnerability details Impact Cross-chain request does not have expiration time Proof of Concept In the current implementation, a caller in source chain can perform a relayer call to starts a cross-chain request. But it is not clearly when the executor will be executing the...

the executor can execute fake cross-chain function call

Lines of code Vulnerability details Impact The caller on relayer side can be rugged if the executor call the executeCall on execution side directly to use consume the nonce and fake cross-chain function call. Proof of Concept The expected behavior is that: the relayer relays a cross-chain request...

6 Quadrillion Token Heist Hits BNB Chain-Based DeFi Protocol Ankr

By Deeba Ahmed According to crypto intelligence firm Arkham, the attacker's wallet address was linked to a developer at Ankr, meaning an inside job can't be ruled out. This is a post from HackRead.com Read the original post: 6 Quadrillion Token Heist Hits BNB Chain-Based DeFi Protocol Ankr...

Researchers Disclose Supply-Chain Flaw Affecting IBM Cloud Databases for PostgreSQL

IBM has fixed a high-severity security vulnerability affecting its Cloud Databases ICD for PostgreSQL product that could be potentially exploited to tamper with internal repositories and run unauthorized code. The privilege escalation flaw CVSS score: 8.8, dubbed "Hell's Keychain" by cloud securi...