GitHub accidentally exposes RSA SSH key

Late last week, GitHub tweeted that it had replaced its RSA SSH "out of an abundance of caution," after accidentally exposing the key on a publicly accessible repository. How the accidental exposure managed to happen is unknown, but it means that anyone that happened to notice it and was able to...

MiniDVBLinux 5.4 - Arbitrary File Read

Exploit Title: MiniDVBLinux 5.4 - Arbitrary File Read Exploit Author: LiquidWorm !/usr/bin/env python3 MiniDVBLinux 5.4 Arbitrary File Read Vulnerability Vendor: MiniDVBLinux Product web page: https://www.minidvblinux.de Affected version: =5.4 Summary: MiniDVBLinuxTM Distribution MLD. MLD offers ...

Making the digital world safer, one Tesla at a time

Contestants gather at Pwn2Own Vancouver to showcase their skills and uncover vulnerabilities...

CVE-2023-26802

An issue in the component /networkconfig/nsgmasq.cgi of DCN Digital China Networks DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request...

Digital China Networks DCBI-Netlog-LAB 路径遍历漏洞

Digital China Networks DCBI-Netlog-LAB DCN DCBI-Netlog-LAB is an Internet Behavior Logging System from Digital China Networks DCN. A security vulnerability exists in Digital China Networks DCBI-Netlog-LAB v1.0. An attacker could exploit the vulnerability to bypass authentication and execute...

CVE-2023-26802

An issue in the component /networkconfig/nsgmasq.cgi of DCN Digital China Networks DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request...

Debian dla-3368 : fonts-opensymbol - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3368 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3368-1 [email protected]...

CVE-2023-26802

DCBI-Netlog-LAB v1.0 (DCN) contains a command-injection flaw in /network_config/nsg_masq.cgi that allows unauthenticated attackers to bypass auth and execute arbitrary OS commands via a crafted request. Affected product: DCBI-Netlog-LAB v1.0; impact per sources is high (unathenticated, arbitrary ...

Western Digital SanDisk PrivateAccess 加密问题漏洞

Western Digital SanDisk PrivateAccess is a secure access software from Western Digital. A security vulnerability exists in Western Digital SanDisk PrivateAccess versions prior to 6.4.9 that stems from the system's support for the insecure TLS 1.0 and TLS 1.1 protocols, which are susceptible to...

Zero-day spells disaster for Bitcoin ATM

Bitcoin ATMs have experienced a severe bout of cash drain after a zero-day bug was exploited to steal a total of $1.5 million in digital currency. The ATMs, located in various convenience stores, function along the lines of regular banking ATMs except your dealings are all in the cryptocurrency...

CVE-2023-0391: MGT-COMMERCE CloudPanel Shared Certificate Vulnerability and Weak Installation Procedures

While using the popular self-hosted web administration solution, CloudPanel from MGT-COMMERCE, Rapid7 researcher Tod Beardsley discovered three security concerns. The first, an issue involving the trustworthiness of the installation script provided by the vendor, was an instance of CWE-494:...

Hackers Steal Over $1.6 Million in Crypto from General Bytes Bitcoin ATMs Using Zero-Day Flaw

Bitcoin ATM maker General Bytes disclosed that unidentified threat actors stole cryptocurrency from hot wallets by exploiting a zero-day security flaw in its software. "The attacker was able to upload his own java application remotely via the master service interface used by terminals to upload...

CVE-2023-25794: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Cross-Site Scripting XSS vulnerability in Mighty Digital Nooz plugin = 1.6.0 versions...

PT-2023-20309 · Unknown · Mighty Digital Nooz

Name of the Vulnerable Software and Affected Versions: Mighty Digital Nooz plugin versions prior to 1.6.0 Description: The issue is related to an Authenticated admin+ Cross-Site Scripting XSS vulnerability. This means that an attacker who has admin access can inject malicious scripts into the...

CVE-2023-0598

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software...

Path traversal

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software...

CVE-2023-0598 GE Digital Proficy Code Injection

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software...

CVE-2023-0598

GE Digital Proficy iFIX (2022, v6.1, v6.5) are affected by CVE-2023-0598 due to improper generation of code (CWE-94). An attacker could insert malicious configuration files in the web server execution path and gain full control of the HMI software. ICSA-23-073-03 lists the affected products and n...

CVE-2023-0598: Improper Control of Generation of Code

GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software...

Gain flexibility and scale with a cloud-native DLP solution

We’re living in a seismic era for data security. Chief information security officers CISOs have to contend with a digital landscape that seems to shift daily as more organizations move to remote and hybrid work, redrawing the boundaries for how data is used and shared. The cloud has enabled...