PT-2023-6049 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel due to a logical bug. This issue may allow a malicious user to cause a use-after-free and...

The US Congress Was Targeted With Predator Spyware

Plus: Hamas raised millions in crypto, Exxon used hacked data, and more...

Internet Bug Bounty: Integrity checks according to policies can be circumvented in Node.js 20 and Node.js 18

Integrity checks according to Node.js policies can be circumvented, allowing untrusted code to execute with elevated permissions. This affects Node.js 18.x and 20.x when using the experimental policy feature. The vulnerability was reported by Tobias Nießen, who also provided a patch that has been...

Malicious NuGet Package Targeting .NET Developers with SeroXen RAT

A malicious package hosted on the NuGet package manager for the .NET Framework has been found to deliver a remote access trojan called SeroXen RAT. The package, named Pathoschild.Stardew.Mod.Build.Config and published by a user named Disti, is a typosquat of a legitimate package called...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

GO-2023-2101 Incorrect exponentiation results in github.com/consensys/gnark-crypto

Incorrect exponentiation results in github.com/consensys/gnark-crypto...

Security Bulletin: Vulnerability in Bouncy Castle Crypto Package affects IBM Process Mining . CVE-2023-33201

Summary There is a vulnerability in Bouncy Castle Crypto Package that could allow a remote authenticated attacker to obtain sensitive information. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details...

Inside FTX’s All-Night Race to Stop a $1 Billion Crypto Heist

The same chaotic day FTX declared bankruptcy, someone began stealing hundreds of millions of dollars from its coffers. A WIRED investigation reveals the company’s “very crazy night” trying to stop them...

kernel security, bug fix, and enhancement update

An update is available for kernel. This update affects Rocky Linux SIG Cloud 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux...

North Korea's Lazarus Group Launders $900 Million in Cryptocurrency

As much as $7 billion in cryptocurrency has been illicitly laundered through cross-chain crime, with the North Korea-linked Lazarus Group linked to the theft of roughly $900 million of those proceeds between July 2022 and July of this year. "As traditional entities such as mixers continue to be...

DoS in System Component lead to System Failure

Lines of code Vulnerability details Impact Proof Of Concept Tools Used Recommended Mitigation Steps Assessed type DoS --- The text was updated successfully, but these errors were encountered: All reactions...

deleted

Lines of code Vulnerability details deleted Assessed type Other --- The text was updated successfully, but these errors were encountered: All reactions...

GO-2023-2096 Signature malleability in github.com/consensys/gnark-crypto

Signature malleability in github.com/consensys/gnark-crypto...

US Police Recover $3M Stolen by Pakistani Crypto Scammers

By Waqas The crypto scammers convinced a victim in the United States to transfer their Bitcoin to a Kraken cryptocurrency account that the victim did not control. This is a post from HackRead.com Read the original post: US Police Recover $3M Stolen by Pakistani Crypto Scammers...

Security Bulletin: IBM Security Verify Privilege On-Premise is affected by multiple security vulnerabilities

Summary IBM Security Verify Privilege On-Premise has addressed several security issues. Please apply the fix as detailed below. Vulnerability Details CVEID:CVE-2022-43891 DESCRIPTION: IBM Security Verify Privilege On-Premises could allow a remote attacker to obtain sensitive information when a...

Stream-Jacking: Malicious YouTube Livestreams Aid Malware, Crypto Scams

By Deeba Ahmed Bitdefender reports a surge in Stream-Jacking attacks on popular YouTube channels, distributing crypto scams and information stealers such as Redline. This is a post from HackRead.com Read the original post: Stream-Jacking: Malicious YouTube Livestreams Aid Malware, Crypto Scams...

K000137107: Crypto++ vulnerability CVE-2022-48570

Security Advisory Description Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-143...

Russian Court Jails Crypto Money Launderer for 12 Years

By Waqas A Russian crypto money launderer and drug trafficker has been sentenced to 11.5 years by the Ryazan region of Russia. This is a post from HackRead.com Read the original post: Russian Court Jails Crypto Money Launderer for 12 Years...

SUSE SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2023:3886-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3886-1 advisory. - CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands may be vulnerable to loss of confidentiality

Summary The Bouncy Castle Crypto Package For Java is used by the MQ Client in IBM App Connect Enterprise Certified Container IntegrationServers and IntegrationRuntimes. This bulletin provides patch information to address the reported vulnerability in the Bouncy Castle Crypto Package For Java...