CVE-2023-36140

In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts...

CVE-2023-36140

CVE-2023-36140 affects PHPJabbers Cleaning Business Software 1.0. The root cause is that user passwords are not encrypted, enabling an attacker to access all user accounts. The entry carries a high-risk impact (CRITICAL, CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No remediation details are p...

Apple macOS Monterey Security Vulnerability

Apple macOS Monterey is the 18th major release of Apple Inc.'s macOS for the Macintosh desktop operating system. A security vulnerability exists in Apple macOS Monterey versions prior to 12.6.8, which stems from the possibility that S/MIME-encrypted email messages may be inadvertently sent in an...

Fedora 38 : cjose (2023-151d5b3da1)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-151d5b3da1 advisory. Security fix for CVE-2023-37464 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

North Korean Hackers Exploit Zero-Day Bug to Target Cybersecurity Researchers

Threat actors associated with North Korea are continuing to target the cybersecurity community using a zero-day bug in an unspecified software over the past several weeks to infiltrate their machines. The findings come from Google's Threat Analysis Group TAG, which found the adversary setting up...

CVE-2023-40271

In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function...

Design/Logic Flaw

In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function...

CVE-2023-40271

In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function...

Security Bulletin: Multiple vulnerabilities in hadoop-mapreduce-client-core-2.7.3.jar affect IBM Application Performance Management products

Summary There are multiple vulnerabilities in hadoop-mapreduce-client-core-2.7.3.jar used by IBM Application Performance Management. IBM Applicatoon Performance Management has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2017-3166 DESCRIPTION: Apache Hadoop could allow a remote...

Information disclosure through insecure design

Introduction Insecure design can lead to many issues. The Software Development Life Cycle SDLC should contain steps to evaluate and consider security throughout the process. Several recent web application and API tests have revealed a common issue of responses containing too much data, and leakin...

A history of ransomware: How did it get this far?

Today's ransomware is the scourge of many organizations. But where did it start? If we define ransomware as malware that encrypts files to extort the owner of the system, then the first malware that could be classified as ransomware is the 1989 AIDS Trojan. However, while it encrypted filenames a...

Oracle Linux 7 : libsrtp (ELSA-2020-3873)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3873 advisory. 1.4.4-11.20101004cvs - Fix global buffer overflow Resolves: bz1301202 - Fix improper handling of CSRC count and extension header length in RTP header...

Oracle Linux 6 : pidgin (ELSA-2011-0616)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0616 advisory. - Add patch for CVE-2011-1091 RH bug 683031. - Remove patches now included upstream: pidgin-2.6.6-clientLogin-proxy-fix.patch...

FreeBSD : FreeBSD -- Wi-Fi encryption bypass (924cb116-4d35-11ee-8e38-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 924cb116-4d35-11ee-8e38-002590c1f29c advisory. - The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept...

Oracle Linux 7 : nss, / nss-softokn, / nss-util, / and / nspr (ELSA-2019-2237)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2237 advisory. nspr 4.21.0-1 - Rebase to NSPR 4.21 nss 3.44.0-4 - Fix certutil man page - Fix extracting a public key from a private key for dh, ec, and dsa 3.44.0-3 ...

Cryptocurrency Startup Loses Encryption Key for Electronic Wallet

The cryptocurrency fintech startup Prime Trust lost the encryption key to its hardware wallet--and the recovery key--and therefore $38.9 million. It is now in bankruptcy. I cant understand why anyone thinks these technologies are a good idea...

FreeBSD -- Wi-Fi encryption bypass

Problem Description: The net80211 subsystem would fallback to the multicast key for unicast traffic in the event the unicast key was removed. This would result in buffered unicast traffic being exposed to any stations with access to the multicast key. Impact: As described in the "Framing Frames:...

FreeBSD-SA-23:11.wifi

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:11.wifi Security Advisory The FreeBSD Project Topic: Wi-Fi encryption bypass Category: core Module: net80211 Announced: 2023-09-06 Credits: See the paper...

Huawei HarmonyOS Encryption Issue Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a message unencryption vulnerability. Successful exploitation of this vulnerability cou...

Open Automation Software OAS Platform OAS Engine authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1776 Open Automation Software OAS Platform OAS Engine authentication bypass vulnerability September 5, 2023 CVE Number CVE-2023-34353 SUMMARY An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation...