Design/Logic Flaw

Server or Console Station DoS due to heap overflow occurring during the handling of a specially crafted message for a specific configuration operation...

CVE-2023-21250

In gattendoperation of gattutils.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

Honeywell Products 缓冲区错误漏洞

Honeywell Products is a family of products from Honeywell USA. A buffer error vulnerability exists in Honeywell Products, which stems from the Experion server DoS is due to a heap overflow that occurs during the processing of a specially crafted message for a specific configuration operation...

PT-2023-3947 · Honeywell · Honeywell Experion Pks

Name of the Vulnerable Software and Affected Versions: Honeywell Experion affected versions not specified Description: The issue is related to a heap overflow occurring during the handling of a specially crafted message for a specific configuration operation, which can lead to a Denial of Service...

PT-2023-3877 · Honeywell · Honeywell Experion Lx +2

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS affected versions not specified Honeywell Experion LX affected versions not specified Experion PlantCruise affected versions not specified Description: The issue is related to a heap overflow occurring during the handli...

Sorare: Operation CreateOrUpdateSo5LineupMutation does not restrict multiple captains

The CreateOrUpdateSo5LineupMutation operation in the Sorare API allowed users to set multiple captains for a football team, which violated the game logic of having only one captain. This vulnerability could be exploited to gain an unfair advantage over other players...

Attacks, Vulnerabilities and Actors 3 July to 9 July 2023

For a detailed threat digest, download the pdf file here Summary HiveForceLabs recently made several significant discoveries related to cybersecurity threats. Over the past week, the fact that there were a total of eight attacks executed, a zero-day vulnerability in the WordPress Plugin, and thre...

Incorrect Bitwise Shift Operation in _validateCall Function

Lines of code Vulnerability details Impact Let's break down this part of the function: if returnedData.length 32 || bytes28bytes32returnedData 32 != bytes280 revert LSP20InvalidMagicValuepostCall, returnedData; This if statement is intended to do two things, as indicated by the two conditions...

Senior OPERA1ER Cybercrime Gang Member Arrested in Global Operation

By Habiba Rashid The cybercrime group has targeted financial institutions, telecoms firms, and mobile banking services, exploiting vulnerabilities to steal funds. This is a post from HackRead.com Read the original post: Senior OPERA1ER Cybercrime Gang Member Arrested in Global Operation...

CVE-2023-1295

...

CVE-2023-37145

TOTOLINK LR350 V9.3.5u.6369B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function...

CVE-2023-37454

An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udfputsuper and udfcloselvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this...

New Variant of RUSTBUCKET Malware Targeting Cryptocurrency Providers

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary RUSTBUCKET malware family is actively developing, adding persistence capabilities, while the REF9135 operation by the DPRK targets cryptocurrency service providers. To receive real-time threat advisories...

INTERPOL Nabs Hacking Crew OPERA1ER's Leader Behind $11 Million Cybercrime

A suspected senior member of a French-speaking hacking crew known as OPERA1ER has been arrested as part of an international law enforcement operation codenamed Nervone, Interpol has announced. "The group is believed to have stolen an estimated USD 11 million -- potentially as much as 30 million -...

ROS-2-127

2.127 Notification on update of the RAND OPERATION SYSTEM "RED OS" No RU.29926343.02.01-01-23 Due to quality improvement and bug fixing, an updated version of MIS Operating System "RED OS" 7.3 has been released. You can contact the technical support service within the framework of your existing...

CVE-2023-37454

An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udfputsuper and udfcloselvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this...

ROS-2-273

2.273 Notification on the update of MIS OPERATION SYSTEM "RED OS" No RU.29926343.02.01-01-23 Due to quality improvement and bug fixing, an updated version of the operating system "RED OS" 7.3 has been released. You can contact the technical support service within the framework of your existing...

ROS-2-1149

2.1149 Notification on the update of MIS OPERATION SYSTEM "RED OS" No RU.29926343.02.01-01-23 Due to quality improvement and bug fixing, an updated version of MIS Operating System "RED OS" 7.3 has been released. You can contact the technical support service within the framework of your existing...

Google Android OS 缓冲区错误漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android OS, which stems from a lack of bounds checking and possible out-of-bounds writes in gattendoperation in gattutils.cc...

CVE-2023-36458 1Panel vulnerable to ommand injection when entering the container terminal

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulnerability has been fixed in v1.3.6...