Denial Of Service (DoS)

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token allowing privilege escalation to organization owner. Fixed in v202107-1.

...

Hive ransomware impacts California non-profit health organisation

Ransomware authors are once again targeting health services, holding important files to ransom and impacting potentially vital services. On this occasion, the victims are a non-profit organisation assisting people with their healthcare needs in California. When Hive ransomware strikes The victim,...

CVE-2012-3905

VMware VMSA-2012-0008/0008.1 documents CVE-2012-3905 among several COS kernel and libxml2 issues affecting ESX/Service Console. The advisory bundles multiple CVEs (e.g., CVE-2011-3191/4348, CVE-2012-0028, CVE-2010-4008, CVE-2011-0216/1944/2834/3919) and specifies remediation via specific patches:...

CVE-2021-41741

CVE-2021-41741 is addressed in the openSUSE/OpenSSL Nextcloud updates. The issue is described as high memory usage when generating a preview for a broken image in Nextcloud Server. Affected software is Nextcloud Server (self-hosted cloud platform); the root cause is related to image preview handl...

CVE-2020-28654

The CVE-2020-28654 entry is linked to a confirmed SSRF vulnerability in vrana/adminer, where an attacker can trigger server-side requests by connecting to privileged ports. Affected software is Adminer; impact is stated as all users. Patches exist: 4.4.0 (unpatched by a previous commit) and 4.7.8...

nacubo.org Cross Site Scripting vulnerability OBB-2454053

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

jira.rescue.org Cross Site Scripting vulnerability OBB-2450860

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction

March 24, 2022 update - As Microsoft continues to track DEV-0537’s activities, tactics, and tools, were sharing new detection, hunting, and mitigation information to give you additional insights on remaining vigilant against these attacks. In recent weeks, Microsoft Security teams have been...

tagiberico.org Improper Access Control vulnerability OBB-2433356

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Leak of Russian Censorship Data

The transparency organization Distributed Denial of Secrets has released 800GB of data from Roskomnadzor, the Russian government censorship organization. Specifically, Distributed Denial of Secrets says the data comes from the Roskomnadzor of the Republic of Bashkortostan. The Republic of...

Russia Wants to Label Meta an ‘Extremist Organization’

Plus: A satellite hack, ransomware extradition, and more of the week’s top security news...

Conti Ransomware Group Diaries, Part III: Weaponry

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what its like to be an employee of Contis sprawling organization. Todays Part III looks at how Conti abused popular commercial...

snowmedical.org.au Improper Access Control vulnerability OBB-2401103

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The Top 5 Russian Cyber Threat Actors to Watch

This post was updated on March 10, 2022 to include a section on the Conti Ransomware Group. As we continue to monitor the situation between Russia and Ukraine – and the potential for global cybersecurity impacts – we realize that our customers and other business and industry stakeholders may be...

CVE-2021-42950

Remote Code Execution RCE vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional...

CVE-2021-42950

Remote Code Execution RCE vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional...

Remote code execution

Remote Code Execution RCE vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional...

CVE-2021-42950

Remote Code Execution RCE vulnerability exists in Zepl Notebooks all previous versions before October 25 2021. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional...

Open OnDemand has an unspecified vulnerability

Osc Open OnDemand is an application of the Osc open source organization in the United States. Open OnDemand has a security vulnerability that could be exploited by an attacker to provide crafted input in job templates...