Crypto Hardware Wallet Ledger's Supply Chain Breach Results in $600,000 Theft

Crypto hardware wallet maker Ledger published a new version of its "@ledgerhq/connect-kit" npm module after unidentified threat actors pushed malicious code that led to the theft of more than $600,000 in virtual assets. The compromise was the result of a former employee falling victim to a phishi...

New Hacker Group 'GambleForce' Tageting APAC Firms Using SQL Injection Attacks

A previously unknown hacker outfit called GambleForce has been attributed to a series of SQL injection attacks against companies primarily in the Asia-Pacific APAC region since at least September 2023. "GambleForce uses a set of basic yet very effective techniques, including SQL injections and th...

Vulnerabilities fixed in Adobe Illustrator

Adobe has fixed vulnerabilities in Illustrator. A malicious party could exploit the vulnerabilities to execute arbitrary code execute arbitrary code. It is possible that code execution could occur with privileges higher than user level. For successful exploitation, the malicious party must trick...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious party could exploit the vulnerabilities to impersonate another user or gain access to sensitive data, potentially including full access to the local file system. Successful exploitation requires the malicious party to tri...

Vulnerabilities fixed in Apple iOS and iPadOS

Apple has fixed vulnerabilities in iOS and iPadOS. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS Manipulation of data Bypassing authentication Remote code execution User rights Access ...

Vulnerabilities fixed in Apple macOS

Apple has fixed vulnerabilities in macOS. A malicious party could exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Denial-of-Service DoS Data manipulation. Remote code execution User rights Access to sensitive data Access to system data Successful...

Vulnerabilities fixed in Google Chrome

Google has fixed vulnerabilities in Chrome. A malicious person could exploit the vulnerabilities to execute arbitrary code with privileges of the browser, or to access sensitive data in the context of the browser. Successful exploitation requires the malicious party to trick the victim into openi...

PUB-A-297030670

In cdparseMsg of cdcodec.c, there is a possible infinite loop due to improper input validation. This could lead to remote denial of service by a rogue cellular base station with no additional execution privileges needed. User interaction is not needed for exploitation...

Vulnerabilities fixed in Apple iOS, iPadOS, MacOS and Safari

Apple has fixed vulnerabilities in iOS, iPadOS, MacOS and Safari. A malicious party could exploit the vulnerabilities to execute arbitrary code with user privileges, or to gain access to sensitive data. Successful exploitation requires the malicious party to trick the victim into following a rogu...

Vulnerabilities fixed in MediaWiki

Vulnerabilities have been fixed in MediaWiki. A malicious party can exploit the vulnerabilities to cause a denial-of-service cause, or to launch a Cross-Site-Scripting attack XSS which may allow the malicious party to grant itself elevated privileges when the administrator of a wiki allows XML...

Vulnerabilities fixed in Foxit PDF Reader and PDF Editor

Foxit has fixed vulnerabilities in PDF Reader and PDF Editor formerly PhantomPDF. A malicious party could exploit them to cause a denial-of-service, execute arbitrary execute arbitrary code with the victim's privileges or to access gain access to sensitive data in the victim's context. Successful...

Vulnerabilities fixed in Mozilla Firefox and Thunderbird

Mozilla has fixed vulnerabilities in Firefox and Thunderbird. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Remote code execution User Rights Spoofing Access to system data Successful...

Vulnerabilities fixed in Fortinet FortiOS and FortiProxy

Fortinet has fixed vulnerabilities in FortiOS and FortiProxy. A malicious party could exploit the vulnerability to cause a denial-of-service, or to reboot the system with a rogue image. To reboot, the malicious party needs prior administrator privileges. Fortinet has released updates to fix the...

Vulnerability fixed in Adobe InCopy

Adobe has fixed a vulnerability in InCopy. A malicious person could exploit the vulnerability to execute arbitrary code with privileges of the victim. For successful abuse, the malicious party must trick the victim into opening a rogue file. Adobe has released updates to fix the vulnerability in...

Vulnerabilities fixed in Adobe Photoshop

Adobe has fixed vulnerabilities in Photoshop. A malicious person can exploit the vulnerabilities to execute arbitrary code with privileges of the victim and to gain access to sensitive data in the victim's context. Successful exploitation requires the malicious party to trick the victim into...

Vulnerabilities fixed in Adobe Premiere Pro

Adobe has fixed vulnerabilities in Premiere Pro. A malicious party could exploit the vulnerabilities to gain access to system data, or to execute arbitrary code with privileges of the victim. Successful exploitation requires the malicious party to trick the victim into opening a rogue file. Adobe...

Vulnerabilities fixed in Adobe Media Encoder

Adobe has fixed vulnerabilities in Media Encoder. A malicious party could exploit the vulnerabilities to gain access to system data, or to execute arbitrary code with privileges of the victim. Successful exploitation requires the malicious party to trick the victim into opening a rogue file. Adob...

Vulnerabilities fixed in Adobe Acrobat and Acrobat Reader

Adobe has fixed vulnerabilities in Acrobat and Acrobat Reader. A malicious person could exploit the vulnerabilities to execute arbitrary execute code with the victim's privileges and to access gain access to sensitive data in the victim's context. Successful exploitation requires the malicious...

Vulnerabilities fixed in Adobe Audition

Adobe has fixed vulnerabilities in Audition. A malicious person could exploit the vulnerabilities to gain access to system data, or to execute arbitrary code with privileges of the victim. Successful exploitation requires the malicious party to trick the victim into opening a rogue file. Adobe ha...

Vulnerabilities fixed in GIMP

Vulnerabilities have been fixed in GIMP. A malicious person could vulnerabilities to execute arbitrary code with victim's privileges, potentially gaining access to sensitive data. Successful exploitation requires the malicious party to trick the victim into opening a rogue file. The developers of...