38946 matches found
Threat Source newsletter (March 31, 2022) — Is "Fortnite" a Metaverse?
By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. By now, anyone on the internet has pondered the question: “Is a hot dog a sandwich?” My two cents: Yes, absolutely. Now as we move into the new internet age and onto Web 3.0 and NFTs instead of... This is only the...
USN-5358-1 linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.13, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities
It was discovered that the network traffic control implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-1055 It was discovered that the IPsec implementati...
USN-5357-1 linux, linux-aws, linux-azure-4.15, linux-dell300x, linux-hwe, linux-kvm, linux-snapdragon vulnerability
It was discovered that the IPsec implementation in the Linux kernel did not properly allocate enough memory when performing ESP transformations, leading to a heap-based buffer overflow. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code...
[SECURITY] Fedora 36 Update: seamonkey-2.53.11.1-1.fc36
SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...
Internet Routing Registry Daemon 安全漏洞
Internet Routing Registry Daemon IRRd is a routing registry daemon. A security vulnerability exists in Internet Routing Registry Daemon, which stems from the fact that IRRd does not always filter password hashes in query responses related to "mntner" objects and database exports. An attacker coul...
PT-2022-3898 · General Electric · Inet +1
Name of the Vulnerable Software and Affected Versions: General Electric Renewable Energy iNET versions prior to 8.3.0 General Electric Renewable Energy iNET II versions prior to 8.3.0 Description: The issue is related to the presence of undocumented configuration commands in the software of Gener...
Cyberattackers Target UPS Back-Up Power Devices in Mission-Critical Environments
Cyberattackers are targeting uninterruptible power supply UPS devices, which provide battery backup power during power surges and outages. UPS devices are usually used in mission-critical environments, safeguarding critical infrastructure installations and important computer systems and IT...
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.
...
CISA Warns of Ongoing Cyber Attacks Targeting Internet-Connected UPS Devices
The U.S. Cybersecurity and Infrastructure Security Agency CISA and the Department of Energy DoE are jointly warning of attacks against internet-connected uninterruptible power supply UPS devices by means of default usernames and passwords. "Organizations can mitigate attacks against their UPS...
Palantir Public: SQL Injection at https://files.palantir.com/ due to CVE-2021-38159
A vulnerability was discovered in an Internet-facing asset files.palantir.com. A proof of concept POC was developed and used to validate the finding. The vulnerability was patched and resolved. Blog about this vulnerability published. You can read full detail here:...
CVE-2022-23937
In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario...
Mitigating Attacks Against Uninterruptable Power Supply Devices
CISA and the Department of Energy DOE are aware of threat actors gaining access to a variety of internet-connected uninterruptable power supply UPS devices, often through unchanged default usernames and passwords. Organizations can mitigate attacks against their UPS devices, which provide emergen...
Wind River VxWorks 缓冲区错误漏洞
Wind River VxWorks is an operating system from Wind River, Inc. an industry-leading real-time operating system for building embedded devices and systems.Wind River VxWorks suffers from a buffer overflow vulnerability that stems from a networked system or product that does not properly validate da...
[SECURITY] Fedora 35 Update: seamonkey-2.53.11.1-1.fc35
SeaMonkey is an all-in-one Internet application suite previously made popular by Netscape and Mozilla. It includes an Internet browser, advanced e-mail, newsgroup and feed client, a calendar, IRC client, HTML editor and a tool to inspect the DOM for web pages. It is derived from the application...
EMQ X 安全漏洞
EMQ X is a fully open source, highly scalable and highly available distributed MQTT messaging agent for IoT, M2M and mobile applications. Suitable for IoT, M2M and mobile applications EMQ programs can handle tens of millions of concurrent clients. EMQ X Dashboard version V3.0.0 contains a user...
Microsoft Internet Explorer Memory Corruption Vulnerability
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service memory corruption via a crafted web site...
Microsoft Internet Explorer Use-After-Free Vulnerability
Use-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object...
The vulnerability of the IPv4 implementation of the Trace TCP/IP protocol allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the IPv4 implementation of the TCP/IP stack is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the implementation of the IPv6 protocol in the Trace TCP/IP stack allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the IPv6 implementation in the Trace TCP/IP stack is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...