PT-2023-7530 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 2023-12-05 security patch Description: The issue is related to the APEX module framework of AOSP, where improperly used crypto could lead to a malicious update of platform components. This could result in local...

PT-2023-7533 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the December 2023 security update Description: The issue is related to a use after free vulnerability in the callback thread event function of com android bluetooth btservice AdapterService.cpp. This could lead to...

November 30, 2023—KB5032278 (OS Build 19045.3758) Preview

None None...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking at the AI Summit New York on December 6, 2023. The list is maintained on this page...

CVE-2022-38973

Improper access control for some IntelR ArcTM graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an authenticated user to potentially enable denial of service or infomation disclosure via local access...

CVE-2023-20588

creationtimestamp| type| source ---|---|--- 2023-08-08 22:14:34+00:00| seen| https://t.me/cibsecurity/68033 2023-12-13 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1182 2023-12-13 11:20:55+00:00| seen| https://t.me/truesecator/5194...

CVE-2023-4016

creationtimestamp| type| source ---|---|--- 2023-08-02 12:39:06+00:00| seen| https://t.me/cibsecurity/67567 2023-11-17 10:13:22+00:00| seen| https://t.me/arpsyndicate/254 2023-12-10 01:21:42+00:00| seen| https://t.me/arpsyndicate/1592...

Hashed Emergent Announces India Blockchain Week (IBW) Conference

By Owais Sultan India Blockchain Week is part of a week-long series of web3-focused events taking place from December 4-10, 2023.… This is a post from HackRead.com Read the original post: Hashed Emergent Announces India Blockchain Week IBW Conference...

CVE-2023-33335

Cross Site Scripting XSS in Sophos Sophos iView The EOL was December 31st 2020 in grpname parameter that allows arbitrary script to be executed...

CVE-2023-33335

Cross Site Scripting XSS in Sophos Sophos iView The EOL was December 31st 2020 in grpname parameter that allows arbitrary script to be executed...

U.S. Authorities Seize 13 Domains Offering Criminal DDoS-for-Hire Services

U.S. authorities have announced the seizure of 13 internet domains that offered DDoS-for-hire services to other criminal actors. The takedown is part of an ongoing international initiative dubbed Operation PowerOFF that's aimed at dismantling criminal DDoS-for-hire infrastructures worldwide. The...

CVE-2023-30399

creationtimestamp| type| source ---|---|--- 2023-05-05 00:37:19+00:00| seen| https://t.me/cibsecurity/63330 2023-11-24 20:05:40+00:00| seen| https://t.me/arpsyndicate/541 2023-12-10 12:53:04+00:00| seen| https://t.me/arpsyndicate/1622...

CVE-2022-46836

creationtimestamp| type| source ---|---|--- 2023-02-20 20:15:58+00:00| seen| https://t.me/cibsecurity/58534 2023-12-21 12:18:51+00:00| seen| https://t.me/ctinow/157637 2026-07-29 12:00:44+00:00| seen| https://t.me/CVEhub/9311 2026-07-30 00:01:14+00:00| seen| https://t.me/CVEhub/9311 2026-07-31...

CVE-2023-23586

creationtimestamp| type| source ---|---|--- 2023-02-17 16:13:07+00:00| published-proof-of-concept| https://t.me/cibsecurity/58430 2024-12-10 23:00:00+00:00| seen| https://u1f383.github.io/linux/2024/12/11/linux-vdso-and-vvar.html 2024-12-20 18:02:36+00:00| published-proof-of-concept|...

CVE-2023-25135

creationtimestamp| type| source ---|---|--- 2023-02-03 07:25:33+00:00| seen| https://t.me/cibsecurity/57440 2023-02-04 17:08:41+00:00| published-proof-of-concept| Telegram/AqbQcSruHnWkutfE8evxRkyLJKRGDqBk7h61RFWxZdE1Lg 2023-02-04 18:01:24+00:00| published-proof-of-concept|...

Ransomware in December 2022

Malwarebytes Threat Intelligence builds a monthly picture of ransomware activity by monitoring the information published by ransomware gangs on their dark web leak sites. This information represents victims who were successfully attacked but opted not to pay a ransom. Lockbit has rebounded from i...

Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices

Researchers are warning about a spike in exploitation attempts weaponizing a now-patched critical remote code execution flaw in Realtek Jungle SDK since the start of August 2022. According to Palo Alto Networks Unit 42, the ongoing campaign is said to have recorded 134 million exploit attempts as...

Fixed in Apache Tomcat 9.0.71

Important: Apache Tomcat denial of service CVE-2023-24998 Apache Tomcat uses a packaged renamed copy of Apache Commons FileUpload to provide the file upload functionality defined in the Jakarta Servlet specification. Apache Tomcat was, therefore, also vulnerable to the Apache Commons FileUpload...

Malware Distribution via Google PPC by IcedID Botnet Distributors

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The IcedID botnet has been using Google pay-per-click ads to distribute itself through malvertising attacks since December 2022. Malvertising involves the use of malicious ads that are displayed in searc...

The Bug Report December 2022 Edition

The Bug Report — December 2022 Edition By Trellix · January 4, 2023 This story was also written by John Borrero Rodriguez Everyone gets it Why am I here? Ho Ho Ho! Welcome back to the Bug Report, or a more fitting name for this time of year: The NAUGHTY List! Yes, we checked it twice. It is no...