TA4557 Targets Recruiters by Delivering Malware Disguised as Job Applicant

Summary: Threat actor TA4557 has been focusing on recruiters by posing as job applicants to distribute malware. While this approach is not unprecedented, there have been notable shifts in both technique and attack vectors compared to their previous methods. The attackers have demonstrated an...

etcd-browser 87ae63d75260 Directory Traversal Vulnerability

An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connecting to the remote server port specified during setup, an attacker can retrieve local operating system files from the remote system...

CVE-2023-47393

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user information via unspecified vectors...

Design/Logic Flaw

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user information via unspecified vectors...

CVE-2023-47393

An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user information via unspecified vectors...

PyPinkSign Security Vulnerability

PyPinkSign is a Python library for NPKI certificates from the individual developer Jung Sang-jun! A security vulnerability exists in PyPinkSign version v0.5.1, which stems from the use of non-random or static IVs for cipher block linking CBC mode in AES encryption, which could lead to information...

Microsoft .NET FormatFtpCommand CRLF Injection Arbitrary File Write and Deletion Vulnerability

This vulnerability allows remote attackers to create or delete arbitrary files on FTP servers implemented using affected versions of Microsoft .NET. Interaction with the .NET framework is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The...

No token whitelist leaves rageQuit() vulnerable to malicious ERC20 token contracts

Lines of code Vulnerability details A malicious actor can exploit the PartyGovernanceNFT.sol::rageQuit function by specifying a malicious IERC20 contract in the withdrawTokens array. The malicious contract could "donate" tokens to the proxy contract to pass the balance check here and when the...

The vulnerability of the TranslationVectors function in the software for converting chemical substance formats in Open Babel allows a hacker to execute arbitrary code.

The vulnerability of the TranslationVectors function in the software for converting chemical substance formats in Open Babel is related to writing outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code using a specially crafted file...

The vulnerability of the TranslationVectors function in the software for converting chemical substance formats in Open Babel allows a hacker to execute arbitrary code.

The vulnerability of the TranslationVectors function in the software for converting chemical substance formats in Open Babel is related to writing outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code using a specially crafted file...

The vulnerability of the TranslationVectors function in the software for converting chemical substance formats in Open Babel allows a hacker to execute arbitrary code.

The vulnerability of the TranslationVectors function in the software for converting chemical substance formats in Open Babel is related to writing outside the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code using a specially crafted file...

Exploit for Incorrect Authorization in Atlassian Confluence_Data_Center

CVE-2023-22518 Improper Authorization Vulnerability in Conflue...

CVE-2023-43905

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors...

Improper access control

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors...

PT-2023-29040 · Writercms · Writercms

Name of the Vulnerable Software and Affected Versions: writercms version 1.1.0 Description: The issue is related to incorrect access control, allowing attackers to directly obtain backend account passwords via unspecified vectors. Recommendations: For writercms version 1.1.0, at the moment, there...

imagemagick:encoder_heic_fuzzer: Index-out-of-bounds in derive_collocated_motion_vectors

Detailed Report: https://oss-fuzz.com/testcase?key=5268697004244992 Project: imagemagick Fuzzing Engine: libFuzzer Fuzz Target: encoderheicfuzzer Job Type: libfuzzerubsanimagemagick Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: derivecollocatedmotionvectors...

Multi-delegate system opens exploits: vote amplification, collusion, rapid alternation, obscuring bribes.

Lines of code Vulnerability details Impact Allowing votes to be spread across multiple delegates does potentially open up new attack vectors if not handled carefully. Some ways this could potentially be exploited: A delegator spreads their votes thin across many dummy delegates they control to...

[SECURITY] [DLA 3606-1] freerdp2 security update

Debian LTS Advisory DLA-3606-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost October 07, 2023 https://wiki.debian.org/LTS Package : freerdp2 Version : 2.3.0+dfsg1-2+deb10u3 CVE ID : CVE-2020-4030 CVE-2020-4031 CVE-2020-4032 CVE-2020-4033 CVE-2020-11017 CVE-2020-110...

CVE-2023-23371

A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixed the vulnerability in the following...

CVE-2023-23371 QVPN Device Client

A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixed the vulnerability in the following...