FreeBSD : Unbound -- Denial of service attack (2368755b-83f6-11ef-8d2e-a04a5edf46d9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2368755b-83f6-11ef-8d2e-a04a5edf46d9 advisory. NLnet labs report: A vulnerability has been discovered in Unbound when handling replies with very large...

[SECURITY] Fedora 40 Update: unbound-1.21.1-3.fc40

Unbound is a validating, recursive, and caching DNSSEC resolver. The C implementation of Unbound is developed and maintained by NLnet Labs. It is based on ideas and algorithms taken from a java prototype developed by Verisign labs, Nominet, Kirei and ep.net. Unbound is designed as a set of modula...

PT-2024-39063

Name of the Vulnerable Software and Affected Versions: NLnet Labs Unbound versions 1.21.0 and earlier Description: The issue arises when handling replies with very large RRsets that require name compression. Malicious upstream responses with very large RRsets can cause Unbound to spend a...

Grafana Labs Incorrect Permission (cve-2024-8118)

The version of Grafana Labs installed on the remote host is prior to 10.3.10, 10.4.9, 11.0.5, 11.1.6, or 11.2.1. It is, therefore, affected by a vulnerability as referenced in the cve-2024-8118 advisory. - In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing...

CVE-2024-23938

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...

CVE-2024-23938 Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...

CVE-2024-23938 Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability

Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...

CVE-2024-23938

The CVE-2024-23938 entry describes a stack-based buffer overflow in the Silicon Labs Gecko OS Debug Interface that allows remote code execution by network-adjacent attackers without authentication. The root cause is improper validation of the length of user-supplied data prior to copying it into ...

Silicon Labs Gecko OS 安全漏洞

Silicon Labs Gecko OS is an operating system designed for Internet of Things IoT devices from Silicon Labs, Inc. It provides secure wired and wireless network connectivity for Silicon Labs' hardware platforms with integrated firmware updates and cloud connectivity support. A security vulnerabilit...

Linux OverlayFS Local Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Local Privilege Escalation via CVE-2023-0386', 'Description' = %q This exploit targets the Linux kernel bug in OverlayFS. A flaw was found in the...

A week in security (September 16 – September 22)

Last week on Malwarebytes Labs: "Simply staggering" surveillance conducted by social media and streaming services, FTC finds Tor anonymity compromised by law enforcement. Is it still safe to use? Walmart customers scammed via fake shopping lists, threatened with arrest Snapchat wants to put your...

Entro Security Labs Releases Non-Human Identities Research Security Advisory

Boston, USA, 16th September 2024, CyberNewsWire...

A week in security (September 9 – September 15)

Last week on Malwarebytes Labs: Ford seeks patent for conversation-based advertising Scammers advertise fake AppleCare+ service via GitHub repos Facebook scrapes photos of kids from Australian user profiles to train its AI PartnerLeak scam site promises victims full access to "cheating" partner’s...

Ransomware Groups Demystified: Lynx Ransomware

As part of our research and tracking of threats, Rapid7 Labs is actively monitoring new and upcoming threat groups and the ransomware domain is known for having a large number of them. In the Ransomware Radar Report, Rapid7 Labs shared the observation that in the first half of 2024, 21 new or...

CloudGoat Official Walkthrough Series: ‘glue_privesc’

The post CloudGoat Official Walkthrough Series: ‘glueprivesc’ appeared first on Rhino Security Labs...

GO-2024-3118 Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill

Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill...

Exploit for OS Command Injection in Progress Loadmaster

CVE-2024-1212 Command Injection Exploit for Kemp LoadMaster 🛡️...

CVE-2024-28100 Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application. This can be triggered by the visitor viewing a li...

SafeTech Labs Launches World’s First Comprehensive Digital Legacy Solution for $52B Industry

Brussel, Belgium, 2nd September 2024, CyberNewsWire...

SSL Labs API Client

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'activesupport/inflector' require 'json' require 'activesupport/coreext/hash' class MetasploitModule uri, 'agent' = useragent, 'method' = 'GET', 'varsget' = para...