Sneaky DogeRAT Trojan Poses as Popular Apps, Targets Indian Android Users

A new open source remote access trojan RAT called DogeRAT targets Android users primarily located in India as part of a sophisticated malware campaign. The malware is distributed via social media and messaging platforms under the guise of legitimate applications like Opera Mini, OpenAI ChatGPT, a...

Wordapp <= 1.5.0 - Authorization Bypass via Insufficiently Unique Cryptographic Signature

The plugin uses an insufficiently unique cryptographic signature in the wapdxopconfigset function, which could allow an unauthenticated attacker to change the validationtoken in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access UR...

The vulnerability of the Horner Automation Cscape EnvisionRV remote control access software and the Cscape configuration software lies in their inability to access an uninitialized pointer, allowing attackers to execute arbitrary code.

The vulnerability of the Horner Automation Cscape EnvisionRV remote control access software and the Cscape configuration software relates to the access to an uninitialized pointer. Exploiting this vulnerability could allow a attacker to execute arbitrary code by opening a specially created CSP fi...

The vulnerability of the microprogramming software of Schneider Electric Easergy T200 remote control devices allows a intruder to perform unauthorized operations during an authentication process.

The vulnerability of the microprogramming software of Schneider Electric Easergy T200 remote control devices lies in the lack of authentication for a critical function. Exploiting this vulnerability could allow an intruder to perform unauthorized operations remotely...

Serious Unpatched Vulnerability Uncovered in Popular Belkin Wemo Smart Plugs

The second generation version of Belkin's Wemo Mini Smart Plug has been found to contain a buffer overflow vulnerability that could be weaponized by a threat actor to inject arbitrary commands remotely. The issue, assigned the identifier CVE-2023-27217, was discovered and reported to Belkin on...

Malicious code in designer-relationships-a-guide-to-happy-monogamy-positive-polyamory-and-optimistic-open-relationship (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fead2d10a8030f59632981c85f922b207a5f18b86fa7f92dce82b68cf925beae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in network_security_private_communication_in_a_public_world_solution_manual_pdfzip_best__0sm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 410825b4c625b62e3df96687b1462d70f4fffda6f8a733399ad051d99c7dc696 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mutagen 安全漏洞

Mutagen is a new remote development tool that enables your existing local tools to work with code in remote environments such as cloud servers and containers. A security vulnerability exists in Mutagen versions prior to 0.16.6, 0.17.1, and mutagen-compose prior to 0.17.1, which stems from the...

PT-2023-22999 · Mutagen +1 · Mutagen +1

Name of the Vulnerable Software and Affected Versions: Mutagen versions prior to 0.16.6 Mutagen versions prior to 0.17.1 mutagen-compose versions prior to 0.17.1 Description: The issue affects Mutagen's list and monitor commands, making them susceptible to control characters provided by remote...

CLSA-2023-1682705952 kernel: Fix of 7 CVEs

mISDN: fix use-after-free bugs in l1oip timer handlers CVE-2022-3565 - media: rc: Fix use-after-free bugs caused by enetxirqsim CVE-2023-1118 - Bluetooth: btsdio: fix use after free bug in btsdioremove due to unfinished work CVE-2023-1989 - proc: procskipspaces shouldn't think it is working on C...

Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Vulnerability

Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Exploit Author: LiquidWorm Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: PolyEco1000 CPU:2.0.6 FPGA:10.19 PolyEco1000 CPU:1.9.4 FPGA:10.19 PolyEco1000 CPU:1.9.3 FPGA:10....

Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit

!/usr/bin/env python3 -- coding: utf-8 -- Exploit Title: Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit Exploit Author: LiquidWorm Sielco PolyEco Digital FM Transmitter 2.0.6 Authentication Bypass Exploit Vendor: Sielco S.r.l Product web page: https://www.sielco.org...

Sielco PolyEco Digital FM Transmitter 2.0.6 Default Credentials

Sielco PolyEco Digital FM Transmitter 2.0.6 Default Credentials Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: PolyEco1000 CPU:2.0.6 FPGA:10.19 PolyEco1000 CPU:1.9.4 FPGA:10.19 PolyEco1000 CPU:1.9.3 FPGA:10.19 PolyEco500 CPU:1.7.0 FPGA:10.16 PolyEco300 CPU:2.0.2...

Siemens SIMATIC CP443-1 OPC UA9 安全漏洞

Siemens SIMATIC IPC DiagMonitor is a suite of system monitoring and troubleshooting software from Siemens, Germany.The SIMATIC CP 1242-7 and CP 1243-7 LTE communication processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as...

Sielco PolyEco Digital FM Transmitter 2.0.6 Account Takeover / Lockout / EoP

Summary PolyEco is the innovative family of high-end digital FM transmitters of Sielco. They are especially suited as high performance power system exciters or compact low-mid power transmitters. The same cabinet may in fact be fitted with 50, 100, 300, 500, 1000W power stage PolyEco50, 100, 300,...

CVE-2023-1748

The listed versions of Nexx Smart Home devices use hard-coded credentials. An attacker with unauthenticated access to the Nexx Home mobile application or the affected firmware could view the credentials and access the MQ Telemetry Server MQTT server and the ability to remotely control garage door...

PT-2023-2619 · Nexx · Nexx Smart Alarm +2

Name of the Vulnerable Software and Affected Versions: Nexx Garage Door Controller versions NXG-100B, NXG-200 Nexx Smart Plug version NXPG-100W Nexx Smart Alarm version NXAL-100 Description: The issue is related to the use of hard-coded credentials in the firmware of Nexx Smart Home devices. This...

[SECURITY] Fedora 38 Update: libindi-2.0.0-3.fc38

INDI is a distributed control protocol designed to operate astronomical instrumentation. INDI is small, flexible, easy to parse, and scalable. It supports common DCS functions such as remote control, data acquisition, monitoring, and a lot more...

Ivanti Avalanche Remote Control Server RCServlet Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Remote Control Server RCServlet servlet. The issue results from the lack of...

Monetising hacking by shorting commodity shipments

I’m continually asked by the maritime industry about the motivations of hackers. “Why would anyone hack us, we operate ships?” It strikes me that many of the public and a lot of maritime businesses still think of the ‘hacker’ as a solo operator in a dark hoodie in a basement of their parents’...