4324 matches found
Design/Logic Flaw
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access...
New MrAnon Stealer Malware Targeting German Users via Booking-Themed Scam
A phishing campaign has been observed delivering an information stealer malware called MrAnon Stealer to unsuspecting victims via seemingly benign booking-themed PDF lures. "This malware is a Python-based information stealer compressed with cx-Freeze to evade detection," Fortinet FortiGuard Labs...
Decoding MrAnon Stealer’s Plot through Deceptive Emails
Summary: A phishing email campaign employs misleading booking details to lure victims, aiming to deploy a Python-based information stealer known as MrAnon Stealer. This malicious software is designed to pilfer victims credentials, system details, browser sessions, and cryptocurrency extensions...
CVE-2015-8314
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access...
New Bluetooth Attack
New attack breaks forward secrecy in Bluetooth. Three news articles: BLUFFS is a series of exploits targeting Bluetooth, aiming to break Bluetooth sessions forward and future secrecy, compromising the confidentiality of past and future communications between devices. This is achieved by exploitin...
PT-2023-31237 · Unknown · Dreamer Cms
Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: A cross-site scripting XSS issue was found in the article management department. This could potentially allow attackers to inject malicious scripts into websites, affecting user sessions. Recommendations...
See List and kill current AAA VPN Session on the CLI
See and Kill current AAA Sessions...
VulnCheck KEV: CVE-2023-41266
Qlik Sense contains a path traversal vulnerability that allows a remote, unauthenticated attacker to create an anonymous session by sending maliciously crafted HTTP requests. This anonymous session could allow the attacker to send further requests to unauthorized endpoints...
CVE-2023-46121
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie...
Slackware Linux 15.0 / current tigervnc Multiple Vulnerabilities (SSA:2023-317-01)
The version of tigervnc installed on the remote host is prior to 1.12.0 / 1.13.1. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-317-01 advisory. - A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the functio...
Crawlector - Threat Hunting Framework Designed For Scanning Websites For Malicious Objects
Crawlector the name Crawlector is a combination of Crawl er & Detector is a threat hunting framework designed for scanning websites for malicious objects. Note-1 : The framework was first presented at the No Hat conference in Bergamo, Italy on October 22nd, 2022 Slides, YouTube Recording. Also, i...
Digital security sessions at Microsoft Ignite to prepare you for the era of AI
Thousands of security professionals will join us for Microsoft Ignite 2023 from November 14 to 17, 2023, where we will share how to embrace the AI era confidently, with protection for people, data, devices, and apps that extends across clouds and platforms. With more than 45 security sessions,...
Digital security sessions at Microsoft Ignite to prepare you for the era of AI
Thousands of security professionals will join us for Microsoft Ignite 2023 from November 14 to 17, 2023, where we will share how to embrace the AI era confidently, with protection for people, data, devices, and apps that extends across clouds and platforms. With more than 45 security sessions,...
PT-2023-9667 · Cisco · Cisco Unified Contact Center Enterprise +1
Name of the Vulnerable Software and Affected Versions: Cisco Enterprise Chat and Email ECE affected versions not specified Description: A vulnerability in the External Agent Assignment Service EAAS feature could allow an unauthenticated, remote attacker to cause a denial of service DoS condition ...
CVE-2023-5035
A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the cookie to be transmitted in plaintext over an HTTP session. The vulnerability may lead to security risks,...
CVE-2023-5035
CVE-2023-5035 affects the Moxa PT-G503 Series firmware prior to v5.2. The root cause is that the Secure attribute for sensitive cookies in HTTPS sessions is not set, which can allow cookies to be transmitted in plaintext over an HTTP session. Potential impact includes exposure/manipulation of use...
phpMyFAQ Access Control Error Vulnerability
phpMyFAQ is a multi-language, fully database-driven FAQ system. An access control error vulnerability exists in versions prior to phpMyFAQ 3.2.2, which stems from the presence of insufficient session expiration. An attacker can exploit this vulnerability to still use old sessions...
Graphic issue occurs on auto adjust resolution VDA session
Various graphical problems on special programs, such as black/white screen problems, color problems, truncation problems, etc. This problem only occurs on VDAs with automatic resolution adjustment; these problems do not occur with fixed resolutions...
Fedora: Security Advisory for kitty (FEDORA-2023-ab43e2ce21)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...