Oracle Linux 8 : opensc (ELSA-2024-0967)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-0967 advisory. 0.20.0-8 - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS1.5 padding Tenable has extracted the preceding description block directly from...

A week in security (February 19 – February 25)

Last week on Malwarebytes Labs: Joomla! patches XSS flaws that could lead to remote code execution Update now! ConnectWise ScreenConnect vulnerability needs your attention Why ransomware gangs love using RMM tools—and how to stop them Signal to shield user phone numbers by default Vibrator virus...

LockBit Ransomware Group Resurfaces After Law Enforcement Takedown

The threat actors behind the LockBit ransomware operation have resurfaced on the dark web using new infrastructure, days after an international law enforcement exercise seized control of its servers. To that end, the notorious group has moved its data leak portal to a new .onion address on the TO...

RHEL 9 : opensc (RHSA-2024:0966)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0966 advisory. The OpenSC set of libraries and utilities provides support for working with smart cards. OpenSC focuses on cards that support cryptographic operation...

New Leak Shows Business Side of China’s APT Menace

A new data leak that appears to have come from one of Chinas top private cybersecurity firms provides a rare glimpse into the commercial side of Chinas many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign...

A first analysis of the i-Soon data leak

Data from a Chinese cybersecurity vendor that works for the Chinese government has exposed a range of hacking tools and services. Although the source is not entirely clear, it seems that a disgruntled staff member of the group leaked the information on purpose. The vendor, i-Soon aka Anxun is...

Unsecured Database Leaks 153 GB of Filipino Student and Family Data

By Deeba Ahmed Personal Information of 200,000+ Exposed in Philippine School Voucher Program Portal Data Leak. This is a post from HackRead.com Read the original post: Unsecured Database Leaks 153 GB of Filipino Student and Family Data...

Information disclosure

This issue was addressed with improved redaction of sensitive information. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to leak sensitive user information...

Tools for Humanity: IDOR - Leaking of team data (name, email, ID, member ID) via POST /api/v1/graphql `FetchMemberships` operation

The vulnerability allowed individuals no longer associated with the organization to access sensitive team member data due to inadequate validation of user permissions. The information that was potentially accessible included names, email addresses, roles, and IDs of current team members...

LockBit Ransomware's Darknet Domains Seized in Global Law Enforcement Raid

Update: The U.K. National Crime Agency NCA has confirmed the takedown of LockBit infrastructure. Read here for more details. An international law enforcement operation has led to the seizure of multiple darknet domains operated by LockBit, one of the most prolific ransomware groups, marking the...

CVE-2024-25635 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the http://192.168.26.128:8080/admin/api/users/ endpoint, which exposes the details of the provided user ID. This may...

CVE-2023-50951

CVE-2023-50951 affects IBM QRadar Suite and IBM Cloud Pak for Security. In some circumstances, the vulnerable software logs sensitive information about invalid authorization attempts, enabling potential information disclosure from logs. Affected: QRadar Suite versions 1.10.12.0–1.10.17.0 and Clou...

CISA Warning: Akira Ransomware Exploiting Cisco ASA/FTD Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added a now-patched security flaw impacting Cisco Adaptive Security Appliance ASA and Firepower Threat Defense FTD software to its Known Exploited Vulnerabilities KEV catalog, following reports that it's being likely...

CVE-2023-40105

In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40105

In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Information disclosure

In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40105

CVE-2023-40105 affects the Android framework (ActivityManagerService), specifically in backupAgentCreated. The root cause is a missing permission check in this path, enabling local information disclosure. The impact is high confidentiality loss with no integrity or availability impact described, ...

space-time enterprise information integration platform security vulnerability

The yonyou space-time enterprise information integration platform is an information integration platform from China's UFIDA yonyou company. A security vulnerability exists in Yonyou space-time enterprise information integration platform v.9.0 and earlier versions, which originated from a...

RansomHouse am See

RansomHouse am See By Pham Duy Phuc in collaboration with Noël Keijzer and Michaël Schrijver from Northwave · February 14, 2024 This blog was also written by Max Kersten Ransom gangs make big bucks by extorting victims, which sadly isn’t new. Their lucrative business allows them not only to live...

TheTruthSpy stalkerware, still insecure, still leaking data

In 2022, we published an article about how photographs of children taken by a stalkerware-type app were found exposed on the internet because of poor cybersecurity practices by the app vendor. The stalkerware-type app involved, TheTruthSpy, has shown once again that the way in which it handles...