The malware, attacker trends and more that shaped the threat landscape in 2023

The 2023 Cisco Talos Year in Review is now available to download. Once again, the Talos team has meticulously combed through a massive amount of data to analyze the major trends that have shaped the threat landscape in 2023. Global conflict influenced a lot of these trends, altering the tactics a...

Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams

Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that stems from incorrect authentication in the GPS HLOS driver...

Kaspersky Security Bulletin 2023. Statistics

All statistics in this report come from the Kaspersky Security Network KSN global cloud service, which receives information from components in our security solutions. The data was obtained from users who had given their consent to it being sent to KSN. Millions of Kaspersky users around the globe...

PT-2023-24161 · Qualcomm · Gps Hlos Driver

Name of the Vulnerable Software and Affected Versions: GPS HLOS Driver affected versions not specified Description: A cryptographic issue exists in the GPS HLOS Driver while downloading Qualcomm GNSS assistance data. Recommendations: At the moment, there is no information about a newer version th...

OPENSUSE-SU-2023:0388-1 Security update for optipng

This update for optipng fixes the following issues: Update to 0.7.8: CVE-2023-43907: Fixed a global-buffer-overflow vulnerability in the GIF reader boo1215937. Fixed a stack-print-after-scope defect in the error handler. Fixed an assertion failure in the image reduction module. Fixed the...

global-pj.com Improper Access Control vulnerability OBB-3800158

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

MGASA-2023-0333 Updated optipng packages fix a security vulnerability

Updated the optipng package to fix a security vulnerability CVE-2023-43907 and other bugs. The GIF handler was vulnerable to a global buffer overflow...

OESA-2023-1873 optipng security update

OptiPNG is a PNG optimizer that recompresses image files to a smaller size, without losing any information. This program also converts external formats BMP, GIF, PNM and TIFF to optimized PNG, and performs PNG integrity checks and corrections. Security Fixes: OptiPNG v0.7.7 was discovered to...

GHSA-585G-F852-V6P4

creationtimestamp| type| source ---|---|--- 2023-11-30 08:18:10+00:00| seen| https://t.me/arpsyndicate/799...

Jenkins Jira Plugin vulnerable to exposure of system-scoped credentials

Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing the use of system-scoped credentials otherwise reserved for the global configuration. This allows attackers with Item/Configure permission to access and capture credentials they are not...

Jenkins Google Compute Engine Plugin has incorrect permission checks

Jenkins Google Compute Engine Plugin 4.550.vb327fca3db11 and earlier does not correctly perform permission checks in multiple HTTP endpoints. This allows attackers with global Item/Configure permission while lacking Item/Configure permission on any particular job to do the following: - Enumerate...

Moderate: Red Hat Security Advisory: libxml2 security update

An update for libxml2 is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

OSV-2023-1231 Global-buffer-overflow in iaace_estimate_scfs_chan

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64532 Crash type: Global-buffer-overflow READ 4 Crash state: iaaceestimatescfschan iaenhaacplusencqcmain iaenhaacplusencaaccoreencode...

PT-2023-35618 · Git +1 · Libxaac

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as Global-buffer-overflow READ 4. The crash state involves several functions, including iaace estimate sc...

Building our Team in Prague: Meet Martin Votruba

From developing driver-assistance software for a luxury car brand to jumping on board an NFT startup, Martin Votruba, Lead Software Engineer, is not one to shy away from a challenge. In September of 2023, joined Rapid7 as the first hire in its new Prague office. Martin is leveraging Rapid7’s...

libxaac:xaac_enc_fuzzer: Global-buffer-overflow in iaace_estimate_scfs_chan

Project: https://github.com/ittiam-systems/libxaac.git Detailed Report: https://oss-fuzz.com/testcase?key=5189794317336576 Project: libxaac Fuzzing Engine: libFuzzer Fuzz Target: xaacencfuzzer Job Type: libfuzzerasanlibxaac Platform Id: linux Crash Type: Global-buffer-overflow READ 4 Crash Addres...

Lazarus Group Orchestrates Supply Chain Attack on CyberLink Corp

Summary: The Lazarus Group Labyrinth Chollima orchestrated a supply chain attack on CyberLink Corp., manipulating a legitimate application installer to impact over 100 devices globally. The attack involves a second-stage payload, labeled LambLoad, communicating with compromised infrastructure and...

climax-global.com Improper Access Control vulnerability OBB-3795820

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

OSV-2023-1203 Global-buffer-overflow in dissect_zcl_read_attr_struct

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64363 Crash type: Global-buffer-overflow READ 4 Crash state: dissectzclreadattrstruct dissectzbeezcl calldissectorwork...