13102 matches found
DEV-0832 (Vice Society) opportunistic ransomware campaigns impacting US education sector
In recent months, Microsoft has detected active ransomware and extortion campaigns impacting the global education sector, particularly in the US, by a threat actor we track as DEV-0832, also known as Vice Society. Shifting ransomware payloads over time from BlackCat, QuantumLocker, and Zeppelin,...
Important: kernel security, bug fix, and enhancement update
The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: A use-after-free in clsroute filter implementation may lead to privilege escalation CVE-2022-2588 Information leak in scsiioctl CVE-2022-0494 A kernel-info-leak issue in pfkeyregister CVE-2022-13...
harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc
A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service DoS via unspecified vectors...
Race condition
A vulnerability regarding concurrent execution using shared resource with improper synchronization 'Race Condition' is found in the session processing functionality of Out-of-Band OOB Management. This allows remote attackers to execute arbitrary commands via unspecified vectors. The following...
Design/Logic Flaw
A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band OOB Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager DSM versions before 7.1.1-42962...
CVE-2022-3576
A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band OOB Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager DSM versions before 7.1.1-42962...
harfbuzz: integer overflow in the component hb-ot-shape-fallback.cc
A vulnerability found in harfbuzz. An integer overflow in the hb-ot-shape-fallback.cc component allows attackers to cause a denial of service DoS via unspecified vectors...
CVE-2022-41404
An issue in the fetch method in the BasicProfile class of org.ini4j through version v0.5.4 allows attackers to cause a Denial of Service DoS via unspecified vectors...
New Report Uncovers Emotet's Delivery and Evasion Techniques Used in Recent Attacks
Threat actors associated with the notorious Emotet malware are continually shifting their tactics and command-and-control C2 infrastructure to escape detection, according to new research from VMware. Emotet is the work of a threat actor tracked as Mummy Spider aka TA542, emerging in June 2014 as ...
Apple macOS TIFF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. Interaction with the CoreGraphics framework is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within...
Software supply chain security is coming of age
Coalfires first Securealities Software Supply Chain Risk Report revealed dramatic budget increases for enterprise security in general and a growing demand for more testing, training, and process improvements in the battle to defend digital assets. But perhaps the most significant takeaway from th...
Emotet Botnet Started Distributing Quantum and BlackCat Ransomware
The Emotet malware is now being leveraged by ransomware-as-a-service RaaS groups, including Quantum and BlackCat, after Conti's official retirement from the threat landscape this year. Emotet started off as a banking trojan in 2014, but updates added to it over time have transformed the malware...
Explained: Fuzzing for security
Fuzzing, or fuzz testing, is defined as an automated software testing method that uses a wide range of invalid and unexpected data as input to find flaws in the software undergoing the test. The flaws do not necessarily have to be security vulnerabilities. Fuzzing can also bring other undesirable...
PT-2022-24814 · Go-Cvss · Go-Cvss
Name of the Vulnerable Software and Affected Versions: go-cvss versions prior to v0.4.0 Description: The issue arises when a full CVSS v2.0 vector string is parsed using the ParseVector function, potentially leading to an Out-of-Bounds Read due to a lack of tests, causing the Go module to panic...
What’s most important for a CISO in API security?
As threats to networks and systems have changed, so have CISOs’ priorities. API security has grown more important with everything as a service and in the cloud. Todays CISOs must ensure they have a plan for protecting APIs. To learn what’s most crucial when protecting APIs, we surveyed CISOs and...
CVE-2022-36661
xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vipciread. This vulnerability allows attackers to cause a Denial of Service via unspecified vectors...
CVE-2022-36659
xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vipciwrite. This vulnerability allows attackers to cause a Denial of Service via unspecified vectors...
Null pointer dereference
xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vipciread. This vulnerability allows attackers to cause a Denial of Service via unspecified vectors...
Null pointer dereference
xhyve commit dfbe09b was discovered to contain a NULL pointer dereference via the component vipciwrite. This vulnerability allows attackers to cause a Denial of Service via unspecified vectors...