PT-2022-15503 · Sap · Sap Netweaver Application Server Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server Java versions 7.22 through 7.53 Description: The issue arises from improper error handling, allowing an attacker to submit multiple HTTP server requests that result in errors, consuming the memory buffer and...

UBUNTU-CVE-2022-22763

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox 96, Thunderbird 91.6, and Firefox ESR 91.6...

Security Vulnerabilities fixed in Firefox ESR 91.6 — Mozilla

A Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.This bug only affects Firefox on Windows. Other operating systems are unaffected. If a user...

Security Vulnerabilities fixed in Thunderbird 91.6 — Mozilla

A Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.This bug only affects Thunderbird on Windows. Other operating systems are unaffected. If a...

Denial-of-service condition: emergency shutdown after pair creation loses contract funds

Handle static Vulnerability details Impact If the owner of the contract set specifically the Factory owner, executes allowEmergencyWithdraw after the pair is created, then the withdraw functions including the emergencyWithdraw will not function and the funds including the liquidity tokens, will b...

A week in security (January 17 – 23)

Last week on Malwarebytes Labs: CISA calls for urgent action against critical threats Red Cross begs attackers to “Do the right thing” after family reunion service compromised Update now! Chrome patches critical RCE vulnerability in Safe Browsing Combatting SMS and phone fraud: UK government issu...

A week in security (January 17 — 23)

Last week on Malwarebytes Labs: CISA calls for urgent action against critical threats Red Cross begs attackers to “Do the right thing” after family reunion service compromised Update now! Chrome patches critical RCE vulnerability in Safe Browsing Combatting SMS and phone fraud: UK government issu...

What is Cryptojacking Attack ❓ Definition and Prevention

Introduction A conceivable threat to cryptocurrency owners, cryptojacking is an attack using which threat attackers can mine cryptocurrency at the expenditure of the target’s resources and network health. If not managed properly at the premature stage, the consequences of this vulnerability can b...

Top Illicit Carding Marketplace UniCC Abruptly Shuts Down

A top underground market for buying and selling stolen credit-card details, UniCC, has announced it’s shutting down operations. The site accounted for about 30 percent of carding scam business and, since it was launched in 2013, handled about $358 million in cryptocurrency transactions, according...

Faking an iPhone Reboot

Researchers have figured how how to intercept and fake an iPhone reboot: Well dissect the iOS system and show how its possible to alter a shutdown event, tricking a user that got infected into thinking that the phone has been powered off, but in fact, its still running. The "NoReboot" approach...

This Week in Security News - January 7th, 2022

This week, read about Log4j vulnerabilities in connected cars and charging stations and how iOS malware can fake iPhone shutdowns to snoop on cameras and microphones...

New iPhone malware spies via camera when device appears off

When removing malware from an iOS device, it is said that users need to restart the device to clear the malware from memory. That is no longer the case. Security researchers from ZecOps have created a new proof-of-concept PoC iPhone Trojan capable of doing "fun" things. Not only can it fake a...

Apple iPhone Malware Tactic Causes Fake Shutdowns to Enable Spying

In the world of mobile malware, simply shutting down a device can often wipe out any bad code, given that persistence after rebooting is a challenge for traditional malicious activity. But a new iPhone technique can hijack and prevent any shut-down process that a user initiates, simulating a real...

New Trick Could Let Malware Fake iPhone Shutdown to Spy on Users Secretly

Researchers have disclosed a novel technique by which malware on iOS can achieve persistence on an infected device by faking its shutdown process, making it impossible to physically determine if an iPhone is off or otherwise. The discovery — dubbed "NoReboot" — comes courtesy of mobile security...

Updated gnome-shell packages fix security vulnerability

Drop extra capabilities from gnome-shell. They're optional and they break shutdown from the login screen with new glibs. CVE-2021-3982...

Backdoor.Win32.Wollf.m Weak Hardcoded Password

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/b125a9a083447ad7d437e3e7f3ed5325.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Wollf.m Vulnerability: Weak Hardcoded Password Description: The malware listens on TC...

PT-2025-37514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's DRM/MSM subsystem related to inconsistent handling of hardware shutdown logic in the .remove and .shutdown callbacks. The .remove and .shutdown...

PT-2025-8053

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential NULL dereference issue has been resolved in the Linux kernel, specifically in the drm/sprd component. The issue occurred because drm could be null in sprd drm shutdown,...

The vulnerability of the P2MP communication technology’s implementation in Junos operating systems and Junos OS Evolved allows a attacker to trigger an emergency shutdown of the application.

The vulnerability of the P2MP communication technology in Junos operating systems and Junos OS Evolved lies in buffer out-of-buffer writing. Exploiting this vulnerability can allow a malicious actor to cause an application to terminate abnormally due to a failure in the RPD process...

Atomix Denial of Service Vulnerability (CNVD-2021-101704)

Atomix is a fault-tolerant distributed orchestration framework for JAVA 8. A denial-of-service vulnerability exists in Atomix version 3.1.5. An attacker could exploit this vulnerability to cause a denial of service via a false member shutdown event message...