7633 matches found
Salfram: Robbing the place without removing your name tag
By Holger Unterbrink and Edmund Brumaghin. Threat summary Cisco Talos recently uncovered a series of email campaigns utilizing links to malicious documents hosted on legitimate file-sharing platforms to spread malware.The campaigns distributed various malware payloads including Gozi ISFB, ZLoader...
Good news: Stalkerware survey results show majority of people aren’t creepy
Back in July, we sent out a survey to Malwarebytes Labs readers on the subject of stalkerware—the term used to describe apps that can potentially invade someone’s privacy. We asked one question: “Have you ever used an app to monitor your partner’s phone?” The results were reassuring. We received...
Achieving Product Platform mindset
Imperva has decided to gradually shift to a company-wide Platform mindset in which, instead of having a set of separate products and features, there is a set of capabilities and building blocks upon which the products and features are built. Until now, special Platform teams have developed Platfo...
Hyperledger: The “payload” Field of Transactions in a Block Reveals the Private Data to All Peers
To whom it may concern, We are a research group conducting research on Hyperledger Fabric 2.0. We find a design flaw about the “payload” field of transactions, which can reveal the Private Data to all peers in one channel. When a client invokes a function to read the private data, the is stored i...
ceph: radosgw: HTTP header injection via CORS ExposeHeader tag
A flaw was found in the Red Hat Ceph Storage RadosGW Ceph Object Gateway. The vulnerability is related to the injection of HTTP headers via a CORS ExposeHeader tag. The newline character in the ExposeHeader tag in the CORS configuration file generates a header injection in the response when the...
CVE-2020-1493
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an...
CVE-2020-9767
A vulnerability related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed...
CVE-2020-9767
A vulnerability related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed...
CVE-2020-9767
CVE-2020-9767 affects Zoom for Windows, involving a DLL-loading vulnerability in the Zoom Sharing Service that could allow a locally authenticated attacker with elevated privileges to run arbitrary code via a malicious DLL. Zoom addressed this in Zoom client 5.0.4 (Windows). As per sources, the i...
CVE-2020-9767: Uncontrolled Search Path Element
A vulnerability related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed...
PT-2020-20744
Name of the Vulnerable Software and Affected Versions Zoom versions prior to 5.0.4 Description A issue related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service allows an attacker with local access and elevated privileges to elevate system privileges using a malicious DLL. This...
Amazon Fixes Alexa Glitch That Could Have Divulged Personal Data
UPDATE Vulnerabilities in Amazon’s Alexa virtual assistant platform could allow attackers to access users’ personal information, like home addresses – simply by persuading them to click on a malicious link. Researchers with Check Point found several web application flaws on Amazon Alexa subdomain...
CVE-2020-13291
In GitLab before 13.2.3, project sharing could temporarily allow too permissive access...
CVE-2020-13291
In GitLab before 13.2.3, project sharing could temporarily allow too permissive access...
CVE-2020-13291
In GitLab before 13.2.3, project sharing could temporarily allow too permissive access...
Design/Logic Flaw
In GitLab before 13.2.3, project sharing could temporarily allow too permissive access...
CVE-2020-13291
In GitLab before 13.2.3, project sharing could temporarily allow too permissive access...
CVE-2020-13291
GitLab CVE-2020-13291 affects GitLab prior to version 13.2.3. The issue enables project sharing to temporarily grant overly permissive access, constituting a privilege/authorization flaw in the sharing logic. The vulnerability is tied to GitLab’s project sharing feature and the root cause is desc...
PT-2020-13432 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.2.3 Description: The issue allows project sharing to temporarily permit overly permissive access. Recommendations: For versions prior to 13.2.3, update to version 13.2.3 or later to resolve the issue...