Ruijie Networks RG-EG Series Routers Security Vulnerability

Ruijie Networks RG-EG Series Routers is a gateway product from China's Ruijie Networks Ruijie Networks. A security vulnerability exists in Ruijie Networks RG-EG Series Routers EG3.01B11P216 and prior versions, which stems from a remote code execution vulnerability...

Multiple Vulnerabilities In Extreme Networks ExtremeXOS

The post Multiple Vulnerabilities In Extreme Networks ExtremeXOS appeared first on Rhino Security Labs...

Code injection

The TETRA TA61 identity encryption function internally uses a 64-bit value derived exclusively from the SCK Class 2 networks or CCK Class 3 networks. The structure of TA61 allows for efficient recovery of this 64-bit value, allowing an adversary to encrypt or decrypt arbitrary identities given on...

Cactus Ransomware Exploits Vulnerabilities in Qlik Sense

Summary: The Cactus ransomware is actively exploiting critical Qlik Sense vulnerabilities, with the ultimate goal of establishing persistence and enabling remote control, infiltrating corporate networks stealthily. This serves as a stark reminder that unpatched Qlik Sense instances are prime...

Fedora: Security Advisory for openvpn (FEDORA-2023-e4df33666c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Key Cybercriminals Behind Notorious Ransomware Families Arrested in Ukraine

A coordinated law enforcement operation has led to the arrest of key individuals in Ukraine who are alleged to be a part of several ransomware schemes. "On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne, and Vinnytsia, resulting in the arrest of the 32-year-old...

CVE-2023-48023

Anyscale Ray 2.6.3 and 2.8.0 allows /logproxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment...

F5 Networks BIG-IP : Apache vulnerability (K000137702)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1.1. It is, therefore, affected by a vulnerability as referenced in the K000137702 advisory. Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility APR-util...

Server side request forgery (ssrf)

google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery SSRF Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set ...

CVE-2023-48711 Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browser

google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery SSRF Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set ...

CVE-2023-48711

google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery SSRF Vulnerability is present in applications utilizing the google-translate-api-browser package and exposing the translateOptions to the end user. An attacker can set ...

Byzro Networks Smart S80 Code Issue Vulnerability

Byzro Networks Smart S80 is an Internet behavior management product from Byzro Networks. A code issue vulnerability exists in Byzro Networks Smart S80 20231108 and prior versions, which stems from the parameter fileupload in the file /sysmanage/updatelib.php resulting in unrestricted uploads...

North Korean Hackers Pose as Job Recruiters and Seekers in Malware Campaigns

North Korean threat actors have been linked to two campaigns in which they masquerade as both job recruiters and seekers to distribute malware and obtain unauthorized employment with organizations based in the U.S. and other parts of the world. The activity clusters have been codenamed Contagious...

Mustang Panda Hackers Targets Philippines Government Amid South China Sea Tensions

The China-linked Mustang Panda actor has been linked to a cyber attack targeting a Philippines government entity amid rising tensions between the two countries over the disputed South China Sea. Palo Alto Networks Unit 42 attributed the adversarial collective to three campaigns in August 2023,...

[SECURITY] Fedora 38 Update: prometheus-podman-exporter-1.5.0-1.fc38

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

[SECURITY] Fedora 39 Update: prometheus-podman-exporter-1.5.0-1.fc39

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

[SECURITY] Fedora 37 Update: prometheus-podman-exporter-1.5.0-1.fc37

Prometheus exporter for podman environments exposing containers, pods, images, volumes and networks information...

Extreme Networks EXOS Security Vulnerability

Extreme Networks EXOS is a software or network operating system used in a network switch from Extreme Networks USA. Extreme Networks EXOS has a security vulnerability that originates when an attacker sends a malicious BGP update message packet that can trigger a denial of service...

GHSA-C6XW-HG9Q-3C9F OpenNMS Cross-site Scripting vulnerability

Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer. Meridian and Horizon installation instructions state that...

OpenNMS Cross-site Scripting vulnerability

Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. The solution is to upgrade to Horizon 32.0.5 or newer and Meridian 2023.1.9 or newer. Meridian and Horizon installation instructions state that...