CVE-2023-29409 Large RSA keys can cause high CPU usage in crypto/tls

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...

GO-2023-1987 Large RSA keys can cause high CPU usage in crypto/tls

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three...

Allocation of Resources Without Limits or Throttling

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: via the crypto/tls process. An attacker can cause excessive CPU consumption by presenting...

CVE-2023-3470

Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account. The predictable nature of the password allows an authenticated user with TMSH access to the BIG-IP system, or anyone with physical access to the FIPS HSM, the information...

PT-2023-24981 · F5 · F5 Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions affected versions not specified Description: The issue concerns F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards, which generate a deterministic password for the Crypto User account. This predictable password allows an...

New NodeStealer Variant Targeting Facebook Business Accounts and Crypto Wallets

Cybersecurity researchers have unearthed a Python variant of a stealer malware NodeStealer that's equipped to fully take over Facebook business accounts as well as siphon cryptocurrency. Palo Alto Networks Unit 42 said it detected the previously undocumented strain as part of a campaign that...

Security Bulletin: The IBM® Engineering Lifecycle Engineering products using IBM Java versions 8.0.7.0 - 8.0.7.11 are vulnerable to crypto attacks. (CVE-2023-30441)

Summary IBM Java versions 8.0.7.0 - 8.0.7.1 has a combination of two flaws in the JSSE component and IBMJCEPlus security provider expose some IBM Java releases to various cryptographic attacks when acting as a TLS server. Following IBM® Engineering Lifecycle Engineering products are vulnerable to...

Beating the Challenge of Cloud Detection and Response with Qualys TotalCloud Deep Learning AI

Lets go beyond the limitations of configuration management-only, non-cloud-native EDR tools for threat detection & response using deep learning AI. The global adoption of cloud technology has supercharged agile innovation in virtually every business sector. As a result, organizations are now...

Police Arrest Suspect in Crypto Millionaire’s Murder

By Waqas The victim, 38-year-old Fernando Perez Algaba, was a self-made cryptocurrency millionaire whose dismembered body was found in a suitcase in an Argentinean town on July 27, 2023. This is a post from HackRead.com Read the original post: Police Arrest Suspect in Crypto Millionaires Murder...

FakeTrade Android Malware Attack Steals Crypto Wallet Data

By Deeba Ahmed Dubbed CherryBlos and FakeTrade by researchers, these two malware campaigns have been identified as potentially related by Trend Micro. This is a post from HackRead.com Read the original post: FakeTrade Android Malware Attack Steals Crypto Wallet Data...

nodejs: DiffieHellman do not generate keys after setting a private key

A vulnerability has been identified in the Node.js, where a generateKeys API function returned from crypto.createDiffieHellman only generates missing or outdated keys, that is, it only generates a private key if none has been set yet...

N. Korean Lazarus Group Suspected in $37.3M CoinsPaid Crypto Heist

By Habiba Rashid CoinsPaid's internal systems were compromised, prompting the firm to temporarily halt operations for four days. This is a post from HackRead.com Read the original post: N. Korean Lazarus Group Suspected in $37.3M CoinsPaid Crypto Heist...

Hackers Target Apache Tomcat Servers for Mirai Botnet and Crypto Mining

Misconfigured and poorly secured Apache Tomcat servers are being targeted as part of a new campaign designed to deliver the Mirai botnet malware and cryptocurrency miners. The findings come courtesy of Aqua, which detected more than 800 attacks against its Tomcat server honeypots over a two-year...

Upgraded Q -> 2 from #899 [1690501938379]

Judge has assessed an item in Issue 899 as 2 risk. The relevant finding follows: issue ! --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #729 [1690502136415]

Judge has assessed an item in Issue 729 as 2 risk. The relevant finding follows: L-02 --- The text was updated successfully, but these errors were encountered: All reactions...

THIS IS A TEST

Lines of code L1 Vulnerability details TESTING REFACTOR Assessed type Context --- The text was updated successfully, but these errors were encountered: All reactions...

TESTING CHANGE SEVERITY

Lines of code L1 Vulnerability details TESTING REFACTOR Assessed type Context --- The text was updated successfully, but these errors were encountered: All reactions...

Security Bulletin: The Bouncy Castle Crypto Package For Java is vulnerable to CVE-2023-33201 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses the Bouncy Castle Crypto Package For Java which is vulnerable to CVE-2023-33201. Vulnerability Details CVEID:CVE-2023-33201 DESCRIPTION: The Bouncy Castle Crypto Package For Java bc-java could allow a remote attacker to obtain sensitiv...

Phishers Exploiting Google Docs to Harvest Crypto Credentials

By Deeba Ahmed The phishing campaign has been dubbed BEC 3.0 by researchers. This is a post from HackRead.com Read the original post: Phishers Exploiting Google Docs to Harvest Crypto Credentials...

Kanti Ransomware Strikes Cryptocurrency Users

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Kanti is a novel strain of ransomware that has been specifically designed to target cryptocurrency users. This sophisticated ransomware is cunningly crafted to infiltrate systems and encrypt files,...