Mozilla Firefox Code Execution Vulnerability (CNVD-2023-68438)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox prior to version 110, which stems from an invalid down conversion in GetTableSelectionMode, and can be exploited by attackers to cause undefined...

The vulnerability in the implementation of HTTP request processing functions of Zyxel switch microprogramming systems series GS1350, GS1915, GS1920, GS2220 allows a perpetrator to cause service interruptions.

The vulnerability of the HTTP request processing function implemented in Zyxel switch microprogramming devices of the GS1350, GS1915, GS1920, and GS2220 series is related to insufficient checking of exceptional states. Exploiting this vulnerability can allow attackers to cause service failures...

Apache Kafka Code Issue Vulnerability (CNVD-2023-23554)

Apache Kafka is an open source distributed streaming platform from the Apache Foundation in the United States. The platform is capable of acquiring real-time data for building applications that react in real time to changes in the data stream. A code issue vulnerability exists in Apache Kafka...

BD Alaris Infusion Central

1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low attack complexity Vendor: Becton, Dickinson and Company BD Equipment: Alaris Infusion Central --------- Begin Update A part 1 of 2 --------- Vulnerability: Storing Passwords in a Recoverable Format --------- End Update A part 1 of 2 --------- 2...

SUSE CVE-2007-2876

The sctpnew function in 1 ipconntrackprotosctp.c and 2 nfconntrackprotosctp.c in Netfilter in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, allows remote attackers to cause a denial of service by causing certain invalid states that trigger a NULL pointer dereference...

SUSE CVE-2009-1926

Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to cause a denial of service TCP outage via a series of TCP sessions that have pending data and a 1 small or 2 zero receive window size, and remain in the...

SUSE CVE-2014-1471

SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL...

SUSE CVE-2017-6353

net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service invalid unlock and double free via a multithreaded application. NOTE: this vulnerability exists because...

SUSE CVE-2018-10981

An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service host OS infinite loop in situations where a QEMU device model attempts to make invalid transitions between states of a request...

SUSE CVE-2022-32923

A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose internal states of the app...

TrickBot gang members sanctioned after pandemic ransomware attacks

In a collaborative partnership, officials in the United States and the United Kingdom unmasked and imposed financial sanctions against seven members of the notorious Russian gang TrickBot alias "TrickLoader", a mainstream banking Trojan turned malware-as-a-service MaaS platform for other criminal...

Apache NiFi XML External Entity Injection Vulnerability (CNVD-2023-23555)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. An XML external entity injection vulnerability exists in Apache NiFi versions 1.2.0 through 1.19.1, which stems fro...

Hackers Targeting U.S. and German Firms Monitor Victims' Desktops with Screenshotter

A previously unknown threat actor has been targeting companies in the U.S. and Germany with bespoke malware designed to steal confidential information. Enterprise security company Proofpoint, which is tracking the activity cluster under the name Screentime , said the group, dubbed TA866 , is like...

Microweber Cross-Site Scripting Vulnerability (CNVD-2023-07919)

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in versions of Microweber prior to 1.3.2, which stems from a security issue in...

Russian Hacker Pleads Guilty to Money Laundering Linked to Ryuk Ransomware

A Russian national on February 7, 2023, pleaded guilty in the U.S. to money laundering charges and for attempting to conceal the source of funds obtained in connection with Ryuk ransomware attacks. Denis Mihaqlovic Dubnikov, 30, was arrested in Amsterdam in November 2021 before he was extradited...

GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry

E-commerce industries in South Korea and the U.S. are at the receiving end of an ongoing GuLoader malware campaign, cybersecurity firm Trellix disclosed late last month. The malspam activity is notable for transitioning away from malware-laced Microsoft Word documents to NSIS executable files for...

Apache InLong Information Disclosure Vulnerability

Apache InLong is the United States Apache Apache Foundation's one-stop massive data integration framework. An information disclosure vulnerability exists in Apache InLong. An attacker can exploit this vulnerability to read arbitrary files on the system...

The vulnerability of JavaScript script handlers for viewing electronic documents in PDF format, specifically within Foxit PDF Reader, arises from insufficient handling of exceptional states. This allows attackers to execute arbitrary JavaScript code.

The vulnerability of JavaScript script handlers in PDF viewer software, such as Foxit PDF Reader, is related to insufficient handling of exceptional states. Exploiting this vulnerability allows a remote attacker to execute arbitrary JavaScript code...

Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices

Researchers are warning about a spike in exploitation attempts weaponizing a now-patched critical remote code execution flaw in Realtek Jungle SDK since the start of August 2022. According to Palo Alto Networks Unit 42, the ongoing campaign is said to have recorded 134 million exploit attempts as...

Adobe Acrobat and Reader Out-of-Bounds Read Vulnerability (CNVD-2023-51689)

Adobe Acrobat Reader is the United States of America Audobee Adobe, a PDF viewer. An out-of-bounds read vulnerability exists in Adobe Acrobat and Reader, which can be exploited by an attacker to cause a sensitive memory leak...