Apple iOS 和 iPadOS 安全漏洞

Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in iOS prior to 16.2 and iPadOS prior to 16.2, which originates from the possibility...

CVE-2023-1802

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

CVE-2023-1802

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

Hardcoded credentials

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

CVE-2023-1802 In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed

In Docker Desktop 4.17.x the Artifactory Integration falls back to sending registry credentials over plain HTTP if the HTTPS health check has failed. A targeted network sniffing attack can lead to a disclosure of sensitive information. Only users who have Access Experimental Features enabled and...

CVE-2023-1802

CVE-2023-1802 affects Docker Desktop 4.17.x where the Artifactory Integration falls back to sending registry credentials over plain HTTP when the HTTPS health check fails. This can allow a targeted network sniffing attack to disclose sensitive information. Affected users are those who have enable...

kernel: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix copyxstatetouabi to copy init states correctly When an extended state component is not present in fpstate, but in init state, the function copies from initfpstate via copyfeature. But, dynamic states are not present ...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from Google, an American company. An information disclosure vulnerability exists in Google Chrome Accessibility, which stems from an out-of-bounds read issue with accessibility features. A remote attacker could exploit this vulnerability to obtain sensitive...

The Future of Fintech Applications

By Owais Sultan This article explores the world of fintech applications, highlighting their most popular features now and in the next… This is a post from HackRead.com Read the original post: The Future of Fintech Applications...

CVE-2022-47444 WordPress ProfilePress Plugin <= 4.4.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin = 4.5.3 versions...

Mélofée: Researchers Uncover New Linux Malware Linked to Chinese APT Groups

An unknown Chinese state-sponsored hacking group has been linked to a novel piece of malware aimed at Linux servers. French cybersecurity firm ExaTrack, which found three samples of the previously documented malicious software that date back to early 2022, dubbed it Mélofée. The newest of the thr...

Trojanized TOR Browser Installers Spreading Crypto-Stealing Clipper Malware

Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022. "Clipboard injectors ... can be silent for years, show no network activity or any other signs of presence...

CVE-2022-47529

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protectio...

PT-2023-7465 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions 4.17.x Description: The issue is related to the transmission of registry data in plain text due to the use of HTTP instead of HTTPS in the Artifactory module of Docker Desktop. This can allow a remote attacker to gain...

CVE-2023-0955 WP Statistics < 14.0 - Authenticated SQLi

The WP Statistics WordPress plugin before 14.0 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By default, the affected feature is available to users with the manageoptions capability admin+, however the plugin has a settings to allow low...

kernel: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix copyxstatetouabi to copy init states correctly When an extended state component is not present in fpstate, but in init state, the function copies from initfpstate via copyfeature. But, dynamic states are not present ...

Threat Roundup for March 17 to March 24

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 17 and March 24. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral...

PT-2023-17765 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a possible out of bounds read in the btm ble read remote features complete function of btm ble gap.cc due to improper input validation. This could lead to local information...

[SECURITY] Fedora 38 Update: kpipewire-5.27.2-2.fc38

It is developed in C++ and it's main use target is QML components. As it's what's been useful, this framework focuses on graphical PipeWire features. If it was necessary, these could be included. At the moment we offer two main components: - KPipeWire: offers the main components to connect to and...

OPENSUSE-SU-2023:0068-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 111.0.5563.64 New View Transitions API CSS Color Level 4 New developer tools in style panel for color functionality CSS added trigonometric functions, additional root font units and extended the n-th child pseudo selector. previousslid...