GoPlus Report: Blockchain Networks Using API Security Data to Mitigate Web3 Threats

By Uzair Amir Singapore, 28 March 2024 - GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report… This is a post from HackRead.com Read the original post: GoPlus Report: Blockchain Networks Using API Security Data to Mitigate Web3 Threats...

PT-2024-3304 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to an error in the initialization of variables in the Core component of Oracle VM VirtualBox. This easily exploitable vulnerability allows a low-privileged attack...

Virtuozzo Hybrid Infrastructure 6.1 (6.1.0-238)

In this release, Virtuozzo Hybrid Infrastructure introduces a new service---Backup and Restore as a Service---as well as provides a range of new features that cover improvements in the compute services and object storage. Additionally, this release delivers stability and security improvements, an...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 4 (6.0.1-91)

This update provides stability improvements. Vulnerability id: VSTOR-70238 A stability fix for iSCSI targets. Vulnerability id: VSTOR-83102 ISCSI volumes may become unavailable due to a race between switching to standby mode and revoking volumes. Vulnerability id: VSTOR-83744 Failed to migrate...

Moderate: Red Hat Security Advisory: logging for Red Hat OpenShift security update

An update is now available for RHOL-5.8-RHEL-9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Moderate: Red Hat Security Advisory: logging for Red Hat OpenShift security update

An update is now available for RHOL-5.6-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

DEBIAN-CVE-2023-45913

Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId. This vulnerability is triggered when the X11 server sends an DRI2BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is ...

@oneuptime/infrastructure-agent (>=7.0.141 <=7.0.1769) potentially affected by CVE-2024-29194 via @oneuptime/common-server (>=7.0.141 <=7.0.1769)

@oneuptime/common-server NPM version =7.0.141, =7.0.141, =7.0.1769 Source cves: CVE-2024-29194 Source advisory: OSV:GHSA-246P-XMG8-WMCQ...

@oneuptime/common-server (>=7.0.141 <=7.0.1814), @oneuptime/common-ui (>=7.0.141 <=7.0.1814) +1 more potentially affected by CVE-2024-29194 via @oneuptime/model (>=7.0.141 <=7.0.1814)

@oneuptime/model NPM version =7.0.141, =7.0.141, =7.0.141, =7.0.141, =7.0.1769 Source cves: CVE-2024-29194 Source advisory: OSV:GHSA-246P-XMG8-WMCQ...

Unveiling AcidPour Evolution of Destructive Malware Targeting Ukraine

Summary: AcidPour, a variant of the destructive AcidRain wiper malware previously used during the Russia-Ukraine conflict, signals a heightened threat to Ukraines critical infrastructure. By targeting Linux UBI and DM logic, AcidPour poses a significant risk to large storage devices and RAID...

Russian Hackers May Have Targeted Ukrainian Telecoms with Upgraded 'AcidPour' Malware

The data wiping malware called AcidPour may have been deployed in attacks targeting four telecom providers in Ukraine, new findings from SentinelOne show. The cybersecurity firm also confirmed connections between the malware and AcidRain, tying it to threat activity clusters associated with Russi...

CISA, FBI, and MS-ISAC Release Update to Joint Guidance on Distributed Denial-of-Service Techniques

Today, CISA, the Federal Bureau of Investigation FBI, and the Multi-State Information Sharing and Analysis Center MS-ISAC released an updated joint guide, Understanding and Responding to Distributed Denial-Of-Service Attacks, to address the specific needs and challenges faced by organizations in...

Advantech WebAccess/SCADA

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 7.1 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Advantech Equipment : WebAccess/SCADA Vulnerability : SQL Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

CLSA-2024-1710947240 Fix of 12 CVEs

CVE-url: https://ubuntu.com/security/CVE-2023-52449 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-url: https://ubuntu.com/security/CVE-2023-39197 - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one CVE-url:...

Security Updates for Microsoft Open Management Infrastructure (March 2024)

The version of Open Management Infrastructure on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in drivers/gpu/drm/drm_atomic.c

A flaw was found in the Linux kernel Direct Rendering Infrastructure DRI subsystem in which a use-after-free can be caused when a user triggers a race condition between a nonblocking atomic commit and a driver unload. A local user could use this flaw to crash the system or potentially escalate...

From Deepfakes to Malware: AI's Expanding Role in Cyber Attacks

Large language models LLMs powering artificial intelligence AI tools today could be exploited to develop self-augmenting malware capable of bypassing YARA rules. "Generative AI can be used to evade string-based YARA rules by augmenting the source code of small malware variants, effectively loweri...

CISA and Partners Release Joint Fact Sheet for Leaders on PRC-sponsored Volt Typhoon Cyber Activity

Today, CISA, the National Security Agency NSA, Federal Bureau of Investigation FBI, and other U.S. and international partners are issuing a joint fact sheet, People’s Republic of China State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders. Partners of this publication includ...

CVE-2024-2599

File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through webshell, compromising the entire infrastructure...

CVE-2024-2599 Unrestricted Upload of File with Dangerous Type vulnerability in AMSS++

File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through webshell, compromising the entire infrastructure...