Stable Channel Update for Desktop

The Stable and extended stable channels has been updated to 114.0.5735.198 for Mac and Linux and 114.0.5735.198/199 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Security Fixes and Rewards Note: Access to bug details and...

CVE-2023-36093

There is a storage type cross site scripting XSS vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3...

CVE-2023-36093

There is a storage type cross site scripting XSS vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3...

CVE-2023-36093

There is a storage type cross site scripting XSS vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3...

CVE-2023-36093

There is a storage type cross site scripting XSS vulnerability in the filing number of the Basic Information tab on the backend management page of EyouCMS v1.6.3...

USN-6146-1: Netatalk vulnerabilities

It was discovered that Netatalk did not properly validate the length of user-supplied data in the DSI structures. A remote attacker could possibly use this issue to execute arbitrary code with the privileges of the user invoking the programs. This issue only affected Ubuntu 20.04 LTS and Ubuntu...

Trusting AI not to lie: The cost of truth: Lock and Code S04E12

In May, a lawyer who was defending their client in a lawsuit against Columbia's biggest airline, Avianca, submitted a legal filing before a court in Manhattan, New York, that listed several previous cases as support for their main argument to continue the lawsuit. But when the court reviewed the...

Stable Channel Update for Desktop

The Stable and extended stable channels has been updated to 114.0.5735.106 for Mac and Linux and 114.0.5735.110 for Windows, which will roll out over the coming days/weeks. A full list of changes in this build is available in the log. Security Fixes and Rewards Note: Access to bug details and lin...

When Low-Tech Hacks Cause High-Impact Breaches

Web hosting giant GoDaddy made headlines this month when it disclosed that a multi-year breach allowed intruders to steal company source code, siphon customer and employee login credentials, and foist malware on customer websites. Media coverage understandably focused on GoDaddys admission that i...

GoDaddy Discloses Multi-Year Security Breach Causing Malware Installations and Source Code Theft

Web hosting services provider GoDaddy on Friday disclosed a multi-year security breach that enabled unknown threat actors to install malware and siphon source code related to some of its services. The company attributed the campaign to a "sophisticated and organized group targeting hosting...

SUSE CVE-2005-2367

Format string vulnerability in the protoitemsettext function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet...

SUSE CVE-2022-22995

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code...

The vulnerability of the dsi_writeinit function in the implementation of the Apple Filing Protocol Netatalk allows a hacker to execute arbitrary code in the context of the root user.

The vulnerability of the dsiwriteinit function in the Apple Filing Protocol Netatalk implementation is related to the possibility of buffer overflow attacks. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the root user remotely...

New T-Mobile Breach Affects 37 Million Accounts

T-Mobile today disclosed a data breach affecting tens of millions of customer accounts, its second major data exposure in as many years. In a filing with federal regulators, T-Mobile said an investigation determined that someone abused its systems to harvest subscriber data tied to approximately ...

globalpatentfiling.com Cross Site Scripting vulnerability OBB-3156377

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Omnicell Healthcare Company Confirms Ransomware Incident

In a US SEC Securities and Exchange Commission 8-K filing, Omnicell, the healthcare technology provider, revealed that some of its products, services, and internal systems were affected by ransomware. Upon detecting the incident, the medication management systems provider took immediate action to...

Grand Theft Auto 6 suffers grand theft

For games publisher Take-Two Interactive, damage control is in full effect as word spreads of a Grand Theft Auto-centric network compromise. Developer Rockstar Games has suffered a major leak of upcoming game content, specifically unfinished video footage of Grand Theft Auto 6. The first anyone...

Vulnerabilities fixed in Netatalk

Vulnerabilities have been fixed in Netatalk. Netatalk is an open-source protocol that allows Unix systems to communicate with Apple systems. Netatalk uses the Apple Filing Protocol; the vulnerabilities found are in this protocol. The vulnerabilities allow an unauthenticated remote malicious perso...

A week in security (April 11 – 17)

Last week on Malwarebytes Labs: Credential-stealing malware disguises itself as Telegram, targets social media users Old Play Store apps served notice by upcoming API level changes Denonia cryptominer is first malware to target AWS Lambda Ransomware: March 2022 review Why identity management...

DEBIAN-CVE-2022-22995

The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code...