Alert: GhostSec and Stormous Launch Joint Ransomware Attacks in Over 15 Countries

The cybercrime group called GhostSec has been linked to a Golang variant of a ransomware family called GhostLocker. "TheGhostSec and Stormous ransomware groups are jointly conducting double extortion ransomware attacks on various business verticals in multiple countries," Cisco Talos researcher...

Unauthorized Access Vulnerability in Great Wall Motor Company Limited Lansan DHT-PHEV Vehicles

Great Wall Motor Company Limited is a globalized intelligent technology company whose business includes automobile and parts design, research and development, production, sales and service. An unauthorized access vulnerability exists in the Great Wall Motor Company Limited Lanshan DHT-PHEV vehicl...

Command Execution Vulnerability in Dahua EIMS System of Zhejiang Dahua Technology Co.

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. A command execution vulnerability exists in the Dahua EIMS system of Zhejiang Dahua Technology Co. Ltd, which can be exploited by attackers to gain server...

Logic flaw vulnerability in KingPortal development system of Beijing Asian Control Technology Development Co. Ltd (CNVD-2024-17442)

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise founded in 1997 as a software platform for industrial automation and informatization. A logic flaw vulnerability exists in the KingPortal development system of Beijing Asian Control Technology Development Co. Ltd. th...

Intel SGX DCAP Buffer Overflow Information Disclosure

The vulnerability of Intel SGX DCAP microprogramming software is related to insufficient validation of input data. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

Command Execution Vulnerability in RG-UAC 6000-E50C at Beijing StarNet Ruijie Network Technology Co.

Ruijie Networks, founded in 2003, is an industry-leading provider of network infrastructure and solutions. A command execution vulnerability exists in the RG-UAC 6000-E50C of Beijing StarNet Ruijie Network Technology Company Limited, which can be exploited by an attacker to execute arbitrary...

SUSE CVE-2021-47055

In the Linux kernel, the following vulnerability has been resolved: mtd: require write permissions for locking and badblock ioctls MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might even be write-once, e.g. for SPI-NOR...

Information leakage vulnerability in KingPortal development system of Beijing Asian Control Technology Development Co. Ltd (CNVD-2024-16583)

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise founded in 1997 as a software platform for industrial automation and informatization. An information leakage vulnerability exists in the KingPortal development system of Beijing Asia Control Technology Development Co...

DEBIAN-CVE-2021-47055

In the Linux kernel, the following vulnerability has been resolved: mtd: require write permissions for locking and badblock ioctls MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might even be write-once, e.g. for SPI-NOR...

CVE-2021-47055

In the Linux kernel, the following vulnerability has been resolved: mtd: require write permissions for locking and badblock ioctls MEMLOCK, MEMUNLOCK and OTPLOCK modify protection bits. Thus require write permission. Depending on the hardware MEMLOCK might even be write-once, e.g. for SPI-NOR...

Why Apple added protection against quantum computing when quantum computing doesn’t even exist yet

Apple released a new update for nearly all its devices that provides an all-new type of encryption for its iMessages to the point that, in theory, iMessages are now protected against attacks from quantum computers. This is a little tricky because, as weve covered before, quantum computers dont...

How the “Frontier” Became the Slogan of Uncontrolled AI

Artificial intelligence AI has been billed as the next frontier of humanity: the newly available expanse whose exploration will drive the next era of growth, wealth, and human flourishing. Its a scary metaphor. Throughout American history, the drive for expansion and the very concept of terrain u...

File Upload Vulnerability in Teaching Management System of Hunan Qiangzhi Technology Development Co.

Hunan Strong Intelligence Technology Development Co., Ltd. is a domestic university informatization service provider and national high-tech enterprise. A file upload vulnerability exists in the Academic Affairs Management System of Hunan Qiangzhi Science and Technology Development Co...

Change Healthcare outages reportedly caused by ransomware

On Wednesday February 21, 2024, Change Healthcare—a subsidiary of UnitedHealth Group—experienced serious system outages due to a cyberattack. In a Form 8-K filing the company said it: “identified a suspected nation-state associated cyber security threat actor had gained access to some of the Chan...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2024 - Includes Oracle January 2024 CPU plus CVE-2023-33850

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 that are used by Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas and Maximo for Utilities a...

x86: shadow stack vs exceptions from emulation stubs

ISSUE DESCRIPTION Recent x86 CPUs offer functionality named Control-flow Enforcement Technology CET. A sub-feature of this are Shadow Stacks CET-SS. CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and...

Command Execution Vulnerability in Electronic Document Security Management System of Beijing Yisaitong Technology Development Co.

Electronic document security management system is an electronic document security protection software, the system utilizes the driver layer transparent encryption technology, through the encryption protection of electronic documents, to prevent internal staff leakage and external personnel to...

SQL Injection Vulnerability in iFair of Beijing Yiharmonic Technology Co.

Enterprise iFair Collaboration Management System is a professional collaborative office software, the management system is highly compatible and suitable for a wide range of business types. There is a SQL injection vulnerability in iFair, which can be exploited by attackers to obtain sensitive...

Weak Password Vulnerability in KingH5Stream of Beijing Asian Control Technology Development Co.

Ltd. is a high-tech industrial automation and informatization software platform enterprise founded in 1997. A weak password vulnerability exists in KingH5Stream, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in DSS of Zhejiang Dahua Technology Co.(CNVD-2024-14629)

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. A SQL injection vulnerability exists in Digital Surveillance System of Zhejiang Dahua Technology Co. Ltd, which can be exploited by attackers to obtain...