Tricky Web Timing Attacks Are Getting Easier to Use—and Abuse

New research shows how known techniques for finding weaknesses in websites are actually practical in uncovering vulnerabilities, for better or worse...

Researchers Uncover Flaws in Windows Smart App Control and SmartScreen

Cybersecurity researchers have uncovered design weaknesses in Microsoft's Windows Smart App Control and SmartScreen that could enable threat actors to gain initial access to target environments without raising any warnings. Smart App Control SAC is a cloud-powered security feature introduced by...

ROS-20240801-01

A vulnerability in the modrewrite function of Apache HTTP Server is related to access control weaknesses. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

Don’t Let Your Domain Name Become a “Sitting Duck”

More than a million domain names -- including many registered by Fortune 100 firms and brand protection companies -- are vulnerable to takeover by cybercriminals thanks to authentication weaknesses at a number of large web hosting providers and domain registrars, new research finds. Image:...

Information Exposure

pimcore/admin-ui-classic-bundle is vulnerable to Information Exposure. The vulnerability is due to the exposure of installation and system details to logged-in users at /admin/index/statistics, which allows to gain insights into the system's configuration and potential weaknesses...

The vulnerability of the TZ Secure OS microprogramming system in embedded Qualcomm chips allows a hacker to execute arbitrary code.

The vulnerability of the TZ Secure OS microprogramming system in embedded Qualcomm chips is related to deficiencies in access control mechanisms. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CLSA-2024-1722003981 httpd: Fix of 5 CVEs

CVE-2024-38474: modrewrite: server weakness with encoded question marks in backreferences - CVE-2024-38475: modrewrite: server weakness in modrewrite when first segment of substitution matches filesystem path - CVE-2024-38477: modproxy: crash resulting in Denial of Service in modproxy via a...

ROS-20240723-05

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an insecure privilege management vulnerability. insecure privilege management. Exploitation of the vulnerability could allow an attacker to escalate their privileges A vulnerability in the...

The vulnerability of the SCADA system MasterSCADA 4D, related to deficiencies in authentication procedures, allows a intruder to read and write arbitrary files.

The vulnerability of the SCADA system MasterSCADA 4D is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to perform read and write operations on arbitrary files...

CGA-WQC5-6GFJ-923C

Bulletin has no description...

RISC Zero zkVM notes on zero-knowledge

RISC Zero zkVM was designed from its inception to provide three main guarantees: 1. Computational integrity: that a given software program executed correctly. 2. Succinctness: that the proof of execution does not grow in relation to the program being executed. 3. Zero Knowledge: that details of t...

Cracking Open the Dual Weaknesses of Rockwell Automation’s PanelView Plus

...

CVE-2023-41928

The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses...

CVE-2023-41927

The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses...

CVE-2023-41928 Remote server offers deprecated TLS protocol in Kiloview P1/P2 devices

The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses...

CVE-2023-41928 Remote server offers deprecated TLS protocol in Kiloview P1/P2 devices

The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses...

CVE-2023-41927 Weak TLS Cipher Suites Supported in Kiloview P1/P2 devices

The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses...

CVE-2023-41927 Weak TLS Cipher Suites Supported in Kiloview P1/P2 devices

The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses...

The vulnerability of the mod_rewrite function in the Apache HTTP Server allows attackers to execute arbitrary code.

The vulnerability of the modrewrite function in the Apache HTTP Server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of VMware vCenter Server’s software management system is related to deficiencies in authentication procedures, which allow attackers to escalate their privileges.

The vulnerability of VMware vCenter Server’s software management software is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to gain increased privileges...