Actors, Threats and Vulnerabilities 15 to 21 May 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made significant discoveries in the field of cybersecurity threats. In the past week, they uncovered a total of eight attacks that were executed, taking advantage of five different vulnerabilities across...

Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title

Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4 Google Dork: intext:"Camaleon CMS is a free and open-source tool and a fexible content management system CMS based on Ruby on Rails" Date: 2023-10-05 Exploit Author: Yasin Gergin Vendor Homepage: http://camaleon.tuzitio.com Softwar...

Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title Vulnerability

Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4 Google Dork: intext:"Camaleon CMS is a free and open-source tool and a fexible content management system CMS based on Ruby on Rails" Exploit Author: Yasin Gergin Vendor Homepage: http://camaleon.tuzitio.com Software Link:...

Indonesian Cybercriminals Exploit AWS for Profitable Crypto Mining Operations

A financially motivated threat actor of Indonesian origin has been observed leveraging Amazon Web Services AWS Elastic Compute Cloud EC2 instances to carry out illicit crypto mining operations. Cloud security company's Permiso P0 Labs, which first detected the group in November 2021, has assigned...

Meta’s $1.3 Billion Fine Is a Strike Against Surveillance Capitalism

The record-breaking GDPR penalty for data transfers to the US could upend Meta's business and spur regulators to finalize a new data-sharing agreement...

neworleansrestaurants.com Cross Site Scripting vulnerability OBB-3355646

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Exploit for Cross-site Scripting in Cloudogu Scm_Manager

CVE-2023-33829: Stored-XSS-on-SC...

Exploit for Cross-site Scripting in Cloudogu Scm_Manager

CVE-2023-33829: Stored-XSS-on-SC...

SUSE-SU-2023:2244-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: - Updated to Intel CPU Microcode 20230512 release. bsc1211382 - New Platforms | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 |...

SUSE-SU-2023:2243-1 Security update for ucode-intel

This update for ucode-intel fixes the following issues: - Updated to Intel CPU Microcode 20230512 release. bsc1211382. - New platforms: | Processor | Stepping | F-M-S/PI | Old Ver | New Ver | Products |:---------------|:---------|:------------|:---------|:---------|:--------- | ADL-N | A0 |...

ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array

A vulnerability was found in NTFS-3G. Incorrect validation of NTFS metadata can result in a heap-based buffer overflow when processing a crafted NTFS image file or partition...

assembly.state.ny.us Cross Site Scripting vulnerability OBB-3341510

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Possible URL spoofing on wildcard path

Description H3 provides the getRequestURL utility using the new URLa, b constructor. When variable a is attacker-controlled the origin of the resulting URL can be modified. Proof of Concept js // index.js import listen from "listhen"; import createApp, createRouter, eventHandler, toNodeListener,...

Water Orthrus's New Campaigns Deliver Rootkit and Phishing Modules

Water Orthrus has been active recently with two new campaigns. CopperStealth uses a rootkit to install malware on infected systems, while CopperPhish steals credit card information. This blog will provide the structure of the campaign and how they work...

Oracle Linux 9 : fwupd (ELSA-2023-2487)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2487 advisory. 1.8.10-2.0.1 - Drop pesign.service restart in postun Orabug: 34760075 - Update signing certificate JIRA: OLDIS-16371 - Rebuild for SecureBoot signature...

CVE-2023-2643

A vulnerability classified as critical was found in SourceCodester File Tracker Manager System 1.0. This vulnerability affects unknown code of the file register/updatepassword.php of the component POST Parameter Handler. The manipulation of the argument newpassword leads to sql injection. The...

WordPress bbPress Plugin < 2.6.5 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:bbpress:bbpress"; if description...

MAL-2023-280 Malicious code in dow-load-the-best-we-could-do-by-thi-bui-on-ipad-new-format- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbe34371c86eb25d33028fc43131c1b1b281f7e57986816c88163b17125302b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-140 Malicious code in bound-to-the-past-stronghold-5-by-golden-angel-on-textbook-new-edition- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c2a2c44d99a498d4ef01c5298b14a9eb8bc90d2d2613d1ed92da9390469d4fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-569 Malicious code in little-heaven-by-nick-cutter-on-kindle-new-pages- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1118eac8c0f8eef839cf2daade621df7e1fc982faf90314a0bbb38622add51c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...