Play ransomware group claims to have stolen hotel chain data

H-Hotels, a large hospitality chain with 60 hotels across several countries including Germany and Switzerland has announced it has fallen victim to a ransomware attack. The incident, which took place on December 11, is allegedly a double whammy of hijacked devices and data theft…if a ransomware...

Getting the correct HTML codecs parameter for an AV1 video

This post is mostly for my own reference, but I couldn't find a good guide elsewhere, so here we go! I wanted to embed a screencast in a web page, and I wanted it to be as efficient as possible. To achieve this, I created two version of the video, and embedded it like this: The MP4 version uses t...

Getting the correct HTML codecs parameter for an AV1 video

This post is mostly for my own reference, but I couldn't find a good guide elsewhere, so here we go! I wanted to embed a screencast in a web page, and I wanted it to be as efficient as possible. To achieve this, I created two version of the video, and embedded it like this: The MP4 version uses t...

[SECURITY] [DLA 3240-1] libde265 security update

Debian LTS Advisory DLA-3240-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost December 15, 2022 https://wiki.debian.org/LTS Package : libde265 Version : 1.0.3-1+deb10u1 CVE ID : CVE-2020-21599 CVE-2021-35452 CVE-2021-36408 CVE-2021-36409 CVE-2021-36410 CVE-2021-3641...

PT-2022-27328 · Wasm3 · Wasm3

Name of the Vulnerable Software and Affected Versions: wasm3 version 7890a2097569fde845881e0b352d813573e371f9 Description: A segmentation fault was discovered in the op CallIndirect component at /m3 exec.h. Recommendations: For version 7890a2097569fde845881e0b352d813573e371f9, consider updating t...

h-brands.com Cross Site Scripting vulnerability OBB-3086118

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

h-watch.jp Cross Site Scripting vulnerability OBB-3066499

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Null pointer dereference

Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain instances of SpiAccessLib could be tricked into writing 0xff to arbitrary system and SMRAM addresses. Fixed in: INTEL Purley-R: 05.21.51.00...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2022-0078)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - An out-of-bounds memory write flaw was found in how the Linux kernel's Voice Over IP H.323 connection tracking functionality handled connections on...

kernel: ext4: avoid cycles in directory h-tree

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes that were already verified under its...

Upgraded Q -> H from 502 [1667614585174]

Judge has assessed an item in Issue 502 as High risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> H from 502 [1667614581063]

Judge has assessed an item in Issue 502 as High risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

h2: Remote Code Execution in Console

A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server’s code, causing remote code execution. This issue is exploited...

PT-2022-24929 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.41.9, 0.42.6, 0.43.7, 0.44.5, 1.41.9, 1.42.6, 1.43.7, and 1.44.5 Description: The issue allows Remote Code Execution RCE in Metabase, a data visualization software, when users can write SQL queries on H2 databases...

Metabase 安全漏洞

Metabase is an open source data analytics platform from Metabase, Inc. in the United States. A security vulnerability exists in Metabase that stems from the fact that H2 the example database can allow Remote Code Execution RCE, which can be abused by users who are able to write SQL queries on the...

October 25, 2022-KB5018858 Cumulative Update Preview for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2

None None...

October 25, 2022—KB5018483 (OS Build 22000.1165) Preview

None None...

CVE-2022-41349

CVE-2022-41349 affects Zimbra Collaboration Suite (ZCS) 8.8.15. The vulnerability is a Reflected XSS in the /h/compose endpoint, where the attachUrl parameter is not properly sanitized, allowing execution of arbitrary JavaScript in a victim’s browser. Affected product/version: ZCS 8.8.15. Underly...

Weak Password Vulnerability in Real-time H.264 IP Camera Monitoring System of Shenzhen Foscombe Intelligent Technology Co.

Shenzhen Foscombe Intelligent Technology Co., Ltd. is a high-tech company headquartered in Shenzhen, Guangdong Province, specializing in network camera products. Real-time H.264 IP Camera Monitoring System of Shenzhen Foscombe Intelligent Technology Co., Ltd. suffers from a weak password...

CVE-2022-38890

CVE-2022-38890 affects Nginx NJS 0.7.7. A segmentation violation is triggered by the njs_utf8_next function in src/njs_utf8.h. Public sources consistently describe the vulnerability as a segmentation fault in NJS, with NVD citing a CVSS v3.1 base score of 5.5 (Medium) and local attack vector, req...