Florida hospital takes entire IT systems offline after 'ransomware attack'

Tallahassee Memorial Healthcare TMH, a major hospital system in northern Florida, has reportedly been experiencing an "IT security issue" since Thursday evening, which impacted some of its IT systems. When TMH learned of the issue, it took its entire IT systems offline as a precaution and contact...

Possible Reentrance & Unexpected Behaviour Vulnerabilities

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. No protection against reentrancy attacks, for example, the pay function called in the mintCallback function does not check for reentrancy before performing an external call. No checking of return values...

Gamaredon Group Launches Cyberattacks Against Ukraine Using Telegram

The Russian state-sponsored cyber espionage group known as Gamaredon has continued its digital onslaught against Ukraine, with recent attacks leveraging the popular messaging app Telegram to strike military and law enforcement sectors in the country. "The Gamaredon group's network infrastructure...

The vulnerability of the Packet Forwarding Engine (PFE) module in Juniper Networks’ Junos operating systems allows a hacker to trigger an emergency shutdown of the application.

The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos operating systems is related to insufficient resource control during its existence. Exploiting this vulnerability can allow a malicious actor to cause an unexpected termination of an application...

Ukraine's DELTA Military System Users Under Attack from Info Stealing Malware

The Computer Emergency Response Team of Ukraine CERT-UA this week disclosed that users of the Delta situational awareness program received phishing emails from a compromised email account belonging to the Ministry of Defense. The attacks, which have been attributed to a threat cluster dubbed...

Fortinet Warns of Active Exploitation of New SSL-VPN Pre-auth RCE Vulnerability

Fortinet on Monday issued emergency patches for a severe security flaw affecting its FortiOS SSL-VPN product that it said is being actively exploited in the wild. Tracked as CVE-2022-42475 CVSS score: 9.3, the critical bug relates to a heap-based buffer overflow vulnerability that could allow an...

CVE-2022-42475: Critical Unauthenticated Remote Code Execution Vulnerability in FortiOS; Exploitation Reported

Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. On December 12, 2022, FortiGuard Labs published advisory FG-IR-22-398 regarding a critical CVSSv3 9.3 “heap-based buffer overflow vulnerability CWE-122 in FortiOS SSL-VPN which may all...

Pool cannot recover from the emergency mode

Lines of code Vulnerability details Impact Pool cannot recover from the emergency mode. If the admin turn on the emergency mode, the user cannot swap or addLiqudity in the pool any more. Proof of Concept In the Pool Contract, the admin factory owner can set the status of the pool to ermergency:...

Pool: The EMERGENCY state cannot be recovered

Lines of code Vulnerability details Impact The owner can call Pool.adminAction to set the Pool contract state to EMERGENCY, and in the EMERGENCY state, no liquidity can be added or transferred, and no swaps can be made. However, the Pool contract does not have a function to recover the EMERGENCY...

CVE-2022-39902

Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call...

Authorization

Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call...

CVE-2022-39902

Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call...

PT-2022-25095 · Samsung · Exynos

Name of the Vulnerable Software and Affected Versions: Exynos baseband versions prior to SMR DEC-2022 Release 1 Description: The issue concerns improper authorization, allowing a remote attacker to obtain sensitive information, including the IMEI, via an emergency call. Recommendations: For...

CVE-2022-39902

Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call...

L1ERC20Bridge does not have an emergency stop mechanism to pause the bridge in case of any problems found.

Lines of code Vulnerability details Impact Right now, L1ERC20Bridge implements nonReentrant and access control mechanism to improve security. However, there is not any emergency stop mechanism that can be triggered by an authorized account to pause the bridge in case of some problems. It is highl...

Don’t spend another weekend patching Chrome

As we head into the weekend, Google has released an emergency security update for the Chrome desktop web browser to address a high-severity vulnerability known to be exploited in the wild. This is the seventh Chrome zero-day fixed this year by Google. This security bug CVE-2022-3723; QID 377721 i...

Chrome Zero Day – Just Before the Weekend (again)

As we head into the weekend, Google has released an emergency security update for the Chrome desktop web browser to address a high-severity vulnerability known to be exploited in the wild. This is the seventh Chrome zero-day fixed this year by Google. This security bug CVE-2022-3723; QID 377721 i...

The vulnerability of the QNAP QVR Elite, QVR Pro, and the QVR Guard application for managing emergency switching in video surveillance systems lies in the recording of data beyond the buffer in memory, allowing an intruder to execute arbitrary code.

The vulnerability of QNAP QVR Elite, QVR Pro, and the QVR Guard application, which is used for managing emergency switching of video surveillance systems, lies in data recording beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the QNAP QVR Elite, QVR Pro, and the QVR Guard application for managing emergency switching in video surveillance systems lies in the recording of data beyond the buffer in memory, allowing a intruder to execute arbitrary code.

The vulnerability of QNAP QVR Elite, QVR Pro, and the QVR Guard application, which is used for managing emergency switching of video surveillance systems, lies in data recording beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the QNAP QVR Elite, QVR Pro, and the QVR Guard application for managing emergency switching in video surveillance systems lies in the recording of data beyond the buffer in memory, allowing a intruder to execute arbitrary code.

The vulnerability of QNAP QVR Elite, QVR Pro, and the QVR Guard application, which is used for managing emergency switching of video surveillance systems, lies in data recording beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...