Design/Logic Flaw

Huawei HEGE-560 version 1.0.1.20SP2, OSCA-550 version 1.0.0.71SP1, OSCA-550A version 1.0.0.71SP1, OSCA-550AX version 1.0.0.71SP2, and OSCA-550X version 1.0.0.71SP2 have an insufficient verification vulnerability. An attacker can perform specific operations to exploit this vulnerability by physica...

Centreon 19.10.5 Remote Command Execution

Exploit Title: Centreon 19.10.5 - Remote Command Execution Date: 2020-01-27 Exploit Author: Fabien AUNAY, Omri BASO Vendor Homepage: https://www.centreon.com/ Software Link: https://github.com/centreon/centreon Version: 19.10.5 Tested on: CentOS 7 CVE : - Centreon 19.10.5 Remote Command Execution...

Russian Pleads Guilty to Running 'CardPlanet' to Sell Stolen Credit Cards

Image credit: Times of Israel. Aleksei Burkov, a 29-year-old Russian hacker, on Thursday pleaded guilty to multiple criminal charges for running two illegal websites that helped cyber criminals commit more than $20 million in credit card fraud. The first website Burkov operated was an online...

Huawei EulerOS: Security Advisory for libsolv (EulerOS-SA-2019-2260)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for nasm (EulerOS-SA-2017-1298)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NewStart CGSL CORE 5.05 / MAIN 5.05 : qt5-qtbase Multiple Vulnerabilities (NS-SA-2019-0236)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has qt5-qtbase packages installed that are affected by multiple vulnerabilities: - An issue was discovered in Qt before 5.11.3. A malformed GIF image causes a NULL pointer dereference in QGifHandler resulting in a segmentation...

Hackers Behind GozNym Malware Sentenced for Stealing $100 Million

Three members of an international organized cybercrime group that was behind a multi-million dollar theft primarily against U.S. businesses and financial institutions have been sentenced to prison, the U.S. Justice Department announced. The criminals used the GozNym banking Trojan to break into...

Amazon Linux 2 : libsolv (ALAS-2019-1374)

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world...

EulerOS 2.0 SP3 : ncurses (EulerOS-SA-2019-2634)

According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ncurses 6.1, there is a NULL pointer dereference at function ncparseentry in parseentry.c that will lead to a denial of service attack. The...

Low: libsolv

Issue Overview: There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any...

Gemalto SafeNet Sentinel LDK License Manager Backlink Vulnerability

SafeNet Sentinel LDK License Manager is a license manager. A backlink vulnerability exists in Gemalto SafeNet Sentinel LDK License Manager. The vulnerability arises from a network system or product that does not properly filter the filenames of links or shortcuts that represent unintended...

Botnet found using YouTube to illegally mine cryptocurrency

By Sudais This time again, hackers have been found mining a popular yet anonymized cryptocurrency. Read more to know what these hackers are up to... This is a post from HackRead.com Read the original post: Botnet found using YouTube to illegally mine cryptocurrency...

Stalking the Stalkerware

Ever get the feeling you’re being followed? Unfortunately, when it comes to our digital lives, this is increasingly the case. But while we’re all keen to boost our followers on social media, it’s a different matter when it comes to anonymous third parties secretly stalking us online. Yes, we’re...

Iceweasel-firegpg Backlink Vulnerability

Iceweasel-firegpg is a content encryption package for the Iceweasel browser. A backlink vulnerability in Iceweasel-firegpg versions prior to 0.6, which stems from a network system or product that does not properly filter filenames of links or shortcuts that represent unintended resources, can be...

EulerOS 2.0 SP3 : libsolv (EulerOS-SA-2019-2260)

According to the version of the libsolv package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties...

Illegal Memory Access

libcaca.so is vulnerable to illegal memory access. The vulnerability exists because the function loadimage in common-image.c does not allocate proper size of memory for w and h parameters in BMP loader, causing an integer overflow for 4bpp data...

libsolv: illegal address access in pool_whatprovides in src/pool.h

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application...

Command execution vulnerability in MyuCMS (CNVD-2019-43630)

MyuCMS is a community mall building system developed using ThinkPHP, which is lightweight, fast and easy to expand. MyuCMS has a command execution vulnerability that can be exploited by attackers to execute illegal commands...

Zoho ManageEngine OpManager SQL Injection Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. Zoho ManageEngine OpManager suffers from a SQL injection vulnerability that arises from a database-based application that lacks validation of externally entered SQL statements. An attacker...

FusionPBX SQL Injection Vulnerability

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. An SQL injection vulnerability exists in FusionPBX. An attacker can exploit this...