164 matches found
GO-2024-3199 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly in github.com/landlock-lsm/go-landlock. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly
Impact When using the recommended "best-effort" mode, Go-Landlock did not restrict the TCP bind and connect operations any more when they were requested. This affects Go-Landlock users to whom both of the following conditions apply: They use Landlock rulesets that are supposed to restrict...
GHSA-VV6C-69R6-CHG9 Go-Landlock in best-effort mode did not restrict TCP bind and connect operations correctly
Impact When using the recommended "best-effort" mode, Go-Landlock did not restrict the TCP bind and connect operations any more when they were requested. This affects Go-Landlock users to whom both of the following conditions apply: They use Landlock rulesets that are supposed to restrict...
LockBit Ransomware and Evil Corp Members Arrested and Sanctioned in Joint Global Effort
A new wave of international law enforcement actions has led to four arrests and the takedown of nine servers linked to the LockBit aka Bitwise Spider ransomware operation, marking the latest salvo against what was once a prolific financially motivated group. This includes the arrest of a suspecte...
CVE-2024-46750 PCI: Add missing bridge lock to pci_bus_lock()
In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pcibuslock One of the true positives that the cfgaccesslock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pcibridgesecondarybusreset+0x5d/0x70 RIP:...
CVE-2024-46750 PCI: Add missing bridge lock to pci_bus_lock()
In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pcibuslock One of the true positives that the cfgaccesslock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886 pcibridgesecondarybusreset+0x5d/0x70 RIP:...
Exploit for Use of Password Hash With Insufficient Computational Effort in Fortinet Fortiproxy
FortiOS and FortiProxy Password Hashing Vulnerability to RCE...
CVE-2024-23111
An improper neutralization of input during web page Generation 'Cross-site Scripting' vulnerability CWE-79 in FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions reboot page may allow a remote privileged...
CVE-2024-21754
A use of password hash with insufficient computational effort vulnerability CWE-916 affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged...
Fortinet Fortigate Weak key derivation for backup file (FG-IR-23-423)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-423 advisory. - A use of password hash with insufficient computational effort vulnerability CWE-916 affecting FortiOS version 7.4.3 and...
Fortinet Fortigate xss (FG-IR-23-471)
The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-471 advisory. - An improper neutralization of input during web page Generation 'Cross-site Scripting' vulnerability CWE-79 in FortiOS versi...
The Justice Department Took Down the 911 S5 Botnet
The US Justice Department has dismantled an enormous botnet: According to an indictment unsealed on May 24, from 2014 through July 2022, Wang and others are alleged to have created and disseminated malware to compromise and amass a network of millions of residential Windows computers worldwide...
CVE-2024-2365
CVE-2024-2365 (Musicshelf, Android) affects Musicshelf 1.0/1.1. The vulnerability concerns an unknown function in PinningTrustManager.java (SHA-1 Handler) where manipulation could lead to a password hash with insufficient computational effort. Exploitation is described as possible on a physical d...
LockBit Attempts to Stay Afloat With a New Version
This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations...
Seamonkey: Multiple Vulnerabilities
Background The Seamonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the ‘Mozilla Application Suite’. Description Multiple vulnerabilities have been discovered in Seamonkey. Please review the CVE identifiers reference...
End-to-End Encrypted Instagram and Messenger Chats: Why It Took Meta 7 Years
Mark Zuckerberg personally promised that the privacy feature would launch by default on Messenger and Instagram chat. WIRED goes behind the scenes of the company’s colossal effort to get it right...
Key Cybercriminals Behind Notorious Ransomware Families Arrested in Ukraine
A coordinated law enforcement operation has led to the arrest of key individuals in Ukraine who are alleged to be a part of several ransomware schemes. "On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne, and Vinnytsia, resulting in the arrest of the 32-year-old...
YouTube launches “global effort” to block ad blockers
The ongoing struggle between YouTube and ad blockers is turning users into the victims. YouTube has gone all out in its fight against the use of add-ons, extensions and programs that prevent it from serving ads to viewers around the world. It started out as just a small experiment, but it looks...
DakshSCRA - Source Code Review Assist
Daksh SCRA Source Code Review Assist tool is built to enhance the efficiency of the source code review process, providing a well-structured and organized approach for code reviewers. Rather than indiscriminately flagging everything as a potential issue, Daksh SCRA promotes thoughtful analysis,...