Typhon Stealer back with new variant named Typhon Reborn

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Typhon Stealer, a malware who became widely known for its capabilities to steal crypto wallets, monitor keystrokes, and evade antivirus programs, became widely known in early August 2022. Soon after, the...

MIT Kerberos 输入验证错误漏洞

MIT Kerberos is a Massachusetts Institute of Technology MIT software for authentication in network clusters.Kerberos also serves as a network authentication protocol designed to provide strong authentication services to client/server applications through a key system. There is a security...

Zhejiang Dahua Technology Co., Ltd. in-vehicle monitoring platform has a logic flaw vulnerability

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. A logic flaw vulnerability exists in the vehicle monitoring platform of Zhejiang Dahua Technology Co. Ltd, which can be exploited by attackers to obtain...

s::can moni::tools SQL注入漏洞

s::can moni::tools is a platform from s::can for managing a virtually unlimited number of sites, online probes, analyzers and parameters. A SQL injection vulnerability exists in versions of s::can moni::tools prior to 4.2, which originates from an authenticated attacker being able to gain full...

GSD-2022-1007456 usb: mon: make mmapped memory read only

usb: mon: make mmapped memory read only This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.218 by commit...

GSD-2022-1007338 usb: mon: make mmapped memory read only

usb: mon: make mmapped memory read only This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.148 by commit...

GSD-2022-1007164 usb: mon: make mmapped memory read only

usb: mon: make mmapped memory read only This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.73 by commit...

GSD-2022-1006979 nvme-hwmon: kmalloc the NVME SMART log buffer

nvme-hwmon: kmalloc the NVME SMART log buffer This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.76 by commit...

GSD-2022-1006969 iio: temperature: ltc2983: allocate iio channels once

iio: temperature: ltc2983: allocate iio channels once This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.77 by commit...

GSD-2022-1006936 usb: mon: make mmapped memory read only

usb: mon: make mmapped memory read only This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.1 by commit 08e2c70e549b77f5f3af9c76da00779d5756f99...

AlmaLinux 8 : grafana (ALSA-2022:7519)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2022:7519 advisory. - The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting XSS due to improper sanitization in sanitizeUrl function...

Grafana Competition Conditions Vulnerability

Grafana is a Grafana open source set of open source monitoring tools that provide a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. Grafana has a contention condition vulnerability that stems from the inclusion of a contention...

Grafana Account Enumeration Vulnerability

Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. Grafana has a security vulnerability that stems from the fact that an attacker can bypass access...

CVE-2022-39306

CVE-2022-39306 affects Grafana prior to 9.2.4 (and 8.5.x backport to 8.5.15). The issue is improper input validation during the invitation/sign-up flow that admins use to add members to an organization. An invite link can be used to sign up with arbitrary username/email, enabling an attacker to b...

CVE-2022-39307

Grafana exposes user-enumeration via the forget-password flow. A POST to /api/user/password/sent-reset-email leaks whether a username/email exists by returning a “user not found” message, enabling information disclosure to unauthenticated users. Affected are Grafana installations (versions <= ...

The vulnerability of microprogramming software in the software-hardware environment for monitoring and security protection of IT infrastructure against physical threats, such as the implementation of NetBotz 4, allows a intruder to execute arbitrary code.

The vulnerability of microprogramming software in programming-and-software-based environments for monitoring and security protection of IT infrastructure arises due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute...

L2 deposits might be reverted

Lines of code Vulnerability details Impact L1ERC20Bridge and L1EthBridge contracts have claimFailedDeposit function to withdraw funds from the initiated deposit, which failed when finalizing on L2. However, if the caller is allowed in senderCanCallFunction modifier, this function can be used to...

CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

Virtuozzo Hybrid Infrastructure 5.3 (5.3.0-130)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover Kubernetes as a Service, storage performance, security, monitoring and alerts, and the user interface. Additionally, this release delivers stability improvements and addresses issues found in previous...

Security feature bypass

A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine ISE Software could allow an unauthenticated, remote attacker to negatively affect the performance of an affected device. This vulnerability is due to insufficient management of system resources. An attack...