MoonBounce: New malware deployed by APT41 in UEFI firmware

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. MoonBounce is a new type of malware that hides in the most complex part of an Operating System OS, the Basic Input Output System BIOS chip, and thus persists even after reinstalling your OS or formatting your hard drive...

Deploying Zero Trust Network Access for Secure Application Access? Don’t Forget to Secure Your Employees

Secure your workforce with the help of multi-factor authentication and Akamai's Zero Trust Network Access application in place of a virtual private network VPN...

ADOdb 授权问题漏洞

ADOdb is a PHP database library that provides a powerful abstraction for performing queries and managing databases. A security vulnerability exists in ADOdb that stems from the lack of an effective trust management mechanism in a networked system or product. An attacker can leverage default or...

Microsoft is now disabling Excel 4.0 macros by default

Back in October 2021, Microsoft announced in an email sent to customers that it planned to disable Excel 4.0 macros by default to protect customers from malicious documents. Now, Microsoft says that change has happened. Good news Sometimes good news in the security world comes later than expected...

ZTNAs Address Requirements VPNs Cannot. Here's Why.

I recently hopped on the Lookout podcast to talk about virtual private networks VPNs and how they've been extended beyond their original use case of connecting remote laptops to your corporate network. Even in this new world where people are using personal devices and cloud apps, VPN continues to...

GHSA-883X-6FCH-6WJX Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares

Impact This allows an attacker to create special subclasses of InvocationTargetException that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and...

Trust Boundary Violation due to Incomplete Blacklist in Test Failure Processing in Ares

Impact This allows an attacker to create special subclasses of InvocationTargetException that escape the exception sanitization because JUnit extracts the cause in a trusted context before the exception reaches Ares. This means that arbitrary student code can be executed in a trusted context, and...

Add a timelock to ExchangeFactory.sol:setFeeAddress() (function that sets a key variable)

Handle Dravee Vulnerability details Impact To give more trust to users: functions that set key/critical variables should be put behind a timelock. Proof of Concept Here, a malicious owner could set the feeAddress to his own and the fee from liquidity tokens that get minted would get stolen: . As...

MingSoft Mcms 信任管理问题漏洞

MingSoft Mcms is a complete open source J2ee system from MingSoft, China. v5.2.4 of MingSoft Mcms contains a security vulnerability that stems from the existence of a hard-coded shiro-key in the software, which can be exploited by attackers to execute arbitrary code...

Umbraco Password Reset Vulnerability

Umbraco is a Danish company Umbraco C written in open source content management system CMS. The Umbraco CMS suffers from a password reset vulnerability that stems from a lack of an effective trust management mechanism in a web-based system or product. An attacker could exploit the vulnerability t...

Mattermost Boards Plugin Trust Management Issue Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. The Mattermost Boards plugin in v0.10.0 and prior versions is vulnerable to a trust management issue that stems from the lack of an effective trust management mechanism in the network system or product. An attacker could...

Bosch Amc2 信任管理问题漏洞

Bosch Amc2 is an access modular controller from Bosch, Germany. The Bosch AMC2 is vulnerable to a trust management issue vulnerability that arises from an attacker being able to retrieve a key from the firmware to decrypt network traffic between the AMC2 and the host system. As a result, an...

CVE-2021-34600

Telenot CompasX versions prior to 32.0 use a weak seed for random number generation leading to predictable AES keys used in the NFC tags used for local authorization of users. This may lead to total loss of trustworthiness of the installation...

Le-Yan Dental Management System Trust Management Issue Vulnerability

Le-Yan Dental Management System is a dental management system from Le-Yan, China. Le-Yan dental management system is vulnerable to a trust management issue, which could be exploited by attackers to gain administrator privileges and take control of the system or disrupt services...

Mattermost 代码问题漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. The Mattermost Boards plugin in v0.10.0 and prior versions is vulnerable to a trust management issue that stems from the lack of an effective trust management mechanism in the network system or product. An attacker could...

NETGEAR XR1000 Trust Management Issue Vulnerability

The NETGEAR xr1000 is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks, the NETGEAR XR1000 device suffers from a security vulnerability that stems from the fact that NETGEAR XR1000 devices prior to 1.0.0.58 are subject to...

Schneider Electric Easergy P5 Trust Management Issue Vulnerability

The Schneider Electric Easergy P5 is a protective relay for demanding medium voltage applications from Schneider Electric, France. The Schneider Electric Easergy P5 is vulnerable to a trust management issue, which exists due to the presence of hard-coded credentials in the application code. An...

Real Big Phish: Mobile Phishing & Managing User Fallibility

According to a recent survey from Ivanti, nearly three-quarters 74 percent of IT professionals reported that their organizations have fallen victim to a phishing attack – and 40 percent of those happened in the last month alone. Increasingly, mobile phishing is the culprit. What’s more, nearly ha...

Le-Yan Dental Management System 信任管理问题漏洞

Le-Yan Dental Management System is a dental management system from Le-Yan, China. Le-Yan dental management system is vulnerable to a trust management issue, which could be exploited by attackers to gain administrator privileges and take control of the system or disrupt services...

Design/Logic Flaw

Discourse is an open source discussion platform. Versions prior to 2.7.13 in stable, 2.8.0.beta11 in beta, and 2.8.0.beta11 in tests-passed allow some users to log in to a community before they should be able to do so. A user invited via email to a forum with mustapproveusers enabled is going to ...