PYSEC-2023-239

An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation...

CVE-2023-46446

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...

CVE-2023-46446

An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."...

Rogue Session

asyncssh is vulnerable to a Rogue Session. The vulnerability is caused by a state machine flaw in the the AsyncSSH server while authenticating a client in which results in the client being forced to to log into the attacker's account without the client being able to detect this. An attacker can...

Millenium RAT the $30 Access Ticket to Data Theft

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Millenium RAT, a Win32 executable built on .NET, specifically version 2.4, is available on GitHub for a one-time fee of $30, granting lifetime access. Notably, this RAT is actively developed and has...

CVE-2023-5777

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

Design/Logic Flaw

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777 Weintek EasyBuilder Pro Use of Hard-coded Credentials

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777 Weintek EasyBuilder Pro Use of Hard-coded Credentials

Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the private key is exposed to the public, which could result in obtaining remote control of the crash report server...

CVE-2023-5777

CVE-2023-5777 affects Weintek EasyBuilder Pro. The root issue is use of hard-coded credentials, which can expose the private key after a crash report is sent, potentially allowing remote control of the crash report server. Affected versions are EasyBuilder Pro before v6.07.02, and 6.08.01.592 and...

Malicious code in gatsby-starter-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bc23995a775ff33fc2732574cfd95b0d8efee1cdcadd229b67acde3123fac5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The software for remote control of computers with Intel vPro processors is vulnerable due to a misconfiguration in the link that is accessed before accessing the file. This allows a malicious user to delete any folder they choose.

The vulnerability of the software for remote control of computers with Intel vPro processors in Dell Command Intel vPro Out of Band mode is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability could allow a malicious individual to delete any...

Weintek EasyBuilder Pro

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Weintek Equipment : EasyBuilder Pro Vulnerability : Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain remote...

The vulnerability of Sielco PolyEco1000 digital FM transmitter’s microprogramming software lies in the insufficient limitation on authentication attempts, allowing a intruder to gain full control over the system.

The vulnerability of Sielco PolyEco1000 digital FM transmitter’s microprogramming software is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the system...

PT-2023-10707 · Abus · Abus Tvip Cameras

Name of the Vulnerable Software and Affected Versions: ABUS TVIP cameras affected versions not specified Description: The issue allows attackers to gain control of the program via a crafted string sent to the sprintf function. This is a Buffer Overflow vulnerability in certain ABUS TVIP cameras...

Malicious code in envision-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04e466892f76c4ace03350c7ce2ac6600e0ec4196b1d0bc3dea64be89cf7ffcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VIMESA VHF/FM Transmitter Blue Plus 9.7.1 Denial Of Service Vulnerability

VIMESA VHF/FM Transmitter Blue Plus version 9.7.1 suffers from a denial of service vulnerability. An unauthenticated attacker can issue an unauthorized HTTP GET request to the unprotected endpoint doreboot and restart the transmitter operations. VIMESA VHF/FM Transmitter Blue Plus 9.7.1 doreboot...

VIMESA VHF/FM Transmitter Blue Plus 9.7.1 Denial Of Service

VIMESA VHF/FM Transmitter Blue Plus 9.7.1 doreboot Remote Denial Of Service Vendor: Video Medios, S.A. VIMESA Product web page: https://www.vimesa.es Affected version: img:v9.7.1 Html:v2.4 RS485:v2.5 Summary: The transmitter Blue Plus is designed with all the latest technologies, such as high...

Kimsuky Unveils New Addition to Its Malware Arsenal

Threat Level Actor Report For a detailed threat advisory, download the pdf file here Summary Kimsuky, a cyber-espionage group, is known for infiltrating via spear-phishing attacks, and is recognized for its versatility in using various types of malware and tools to facilitate remote control durin...