New Android Malware CherryBlos Utilizing OCR to Steal Sensitive Data

A new Android malware strain called CherryBlos has been observed making use of optical character recognition OCR techniques to gather sensitive data stored in pictures. CherryBlos, per Trend Micro, is distributed via bogus posts on social media platforms and comes with capabilities to steal...

Metasploit Weekly Wrap up

Unauthenticated RCE in VMware Product This week, community contributor h00die added an exploit module that leverages a command injection vulnerability in VMWare Aria Operations for Networks, formerly known as vRealize Network Insight. Versions 6.2 to 6.10 are vulnerable CVE-2023-20887. A remote...

Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns

Trend Micro’s Mobile Application Reputation Service MARS team discovered two new related Android malware families involved in cryptocurrency-mining and financially-motivated scam campaigns targeting Android users...

Information Disclosure

xen is vulnerable to Information Disclosure. Under specific micro architectural circumstances, an attacker is able to potentially access sensitive user information...

The vulnerability of the monitoring and security management tool Trend Micro Apex Central lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the monitoring and security management tool Trend Micro Apex Central exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created link...

The vulnerability of the monitoring and security management tool Trend Micro Apex Central lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the monitoring and security management tool Trend Micro Apex Central exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created link...

The vulnerability of the monitoring and security management tool Trend Micro Apex Central lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the monitoring and security management tool Trend Micro Apex Central exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created link...

The vulnerability of the monitoring panel widgets of the Trend Micro Apex Central security management and monitoring tool allows a threat actor to execute arbitrary code.

The vulnerability of the monitoring panel of the security monitoring and management tool Trend Micro Apex Central exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created...

PT-2023-4353 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central versions prior to build 6481 Description: A server-side request forgery SSRF vulnerability could allow an attacker to interact with internal or local services directly. The attacker must first obtain the ability to...

PT-2023-4354 · Trend Micro · Trend Micro Apex Central

Name of the Vulnerable Software and Affected Versions: Trend Micro Apex Central version 2019 = Build 6394 Description: The issue is related to insufficient validation of incoming requests in the modTMSL widget monitoring panel module of Trend Micro Apex Central, a security monitoring and manageme...

Trend Micro Apex Central modTXSO Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the modTXSO module. The issue results from the lack of proper validation of...

Trend Micro Apex Central modDeepSecurity Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the modDeepSecurity module. The issue results from the lack of proper...

Trend Micro Apex Central modVulnerabilityProtect Server-Side Request Forgery Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the modVulnerabilityProtect module. The issue results from the lack of prop...

Trend Micro Apex Central modTMSL Server-Side Request Forgery Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex Central. Authentication is required to exploit this vulnerability. The specific flaw exists within the modTMSL module. The issue results from the lack of proper validation of...

Malicious code in hui-micro-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d2f3e6ea52ec1a1674db2757b09ef3de1301aec7ae4e0f6a6128b533179cb071 The OpenSSF Package Analysis project identified 'hui-micro-app' @ 3.0.0 npm as malicious. It is considered malicious because: - The package...

The vulnerability of AMD’s microprogramming software for CPUs based on the Zen2 microarchitecture allows a hacker to access the contents of registers during other processes executed on the same CPU core.

The vulnerability of AMD’s microprogrammed software for CPUs based on the Zen2 microarchitecture is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to monitor the contents of registers during other processes executed by the same CPU core...

SUSE: Security Advisory (SUSE-SU-2023:2945-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AMD EPYC 安全漏洞

AMD EPYC is an x86 architecture server microprocessor product line from AMD Semiconductor, known in Chinese as Xiaolong, which utilizes the Zen microarchitecture. A security vulnerability exists in AMD EPYC, which originated in a specific microarchitecture environment, allowing an attacker to...

PT-2023-3704 · Amd +9 · Amd Ryzen +10

Name of the Vulnerable Software and Affected Versions: AMD Zen 2 processors affected versions not specified Description: The issue in AMD Zen 2 processors, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. This is due to a...

[SECURITY] Fedora 37 Update: dotnet7.0-7.0.109-1.fc37

.NET is a fast, lightweight and modular platform for creating cross platform applications that work on Linux, macOS and Windows. It particularly focuses on creating console applications, web applications and micro-services. .NET contains a runtime conforming to .NET Standards a set of framework...