Aggregator

A vulnerability was found in Michael Arndt WebCal 1.11-3.04. It has been rated as problematic. This issue affects the function (1) of the file webcal.cgi. The manipulation leads to basic cross site scripting. The identification of this vulnerability is CVE-2005-4327. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability was found in dnsmasq. It has been rated as problematic. This issue affects some unknown processing of the component Packet Handler. The manipulation leads to use after free. The identification of this vulnerability is CVE-2022-0934. The attack may be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in Oracle Communications Cloud Native Core Network Function Cloud Native Environment 22.3.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Oracle Linux 8. The manipulation leads to denial of service. This vulnerability is known as CVE-2022-0934. The attack can be launched remotely. There is no exploit available.

A vulnerability has been found in tgt up to 1.0.92 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to insufficient entropy in prng. This vulnerability was named CVE-2024-45751. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in editorconfig-core-c up to 0.12.5 and classified as critical. Affected by this issue is the function ec_glob. The manipulation leads to stack-based buffer overflow. This vulnerability is handled as CVE-2023-0341. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as critical, was found in editorconfig-core-c up to 0.12.6. Affected is an unknown function of the component Parser. The manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2024-53849. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

Notorious ransomware programmer Mikhail Pavlovich Matveev arrested in Russia

Linux 安全工程师 Andrey Konovalov 在本月举行的 POC 2024 安全会议上介绍了如何秘密关闭 ThinkPad 摄像头 LED 指示灯的方法。他开发的概念验证程序通过重刷 ThinkPad X230 摄像头的固件去关闭 LED 指示灯，在用户不知情下悄悄摄录像。今天大部分笔记本电脑都提供了摄像头盖子，可以在不使用时盖住摄像头。他的 Lights Out 源代码发布在 GitHub 上。

A vulnerability has been found in Artifex MuPDF and classified as problematic. Affected by this vulnerability is the function pdf_run_xobject of the file pdf-op-run.c. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2017-5991. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Myproxy 2003-06-29. Affected by this issue is some unknown functionality of the component URL Handler. The manipulation leads to basic cross site scripting. This vulnerability is handled as CVE-2003-1199. The attack may be launched remotely. Furthermore, there is an exploit available.

Wanted Russian Cybercriminal Linked to Hive and LockBit Ransomware Has Been Arrested

A new set of 15 SpyLoan Android malware apps with over 8 million installs was discovered on Google Play, targeting primarily users from South America, Southeast Asia, and Africa. [...]

A vulnerability was found in Apple Mac OS X 10.10/10.10.1. It has been rated as critical. This issue affects some unknown processing of the component bash. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2014-7187. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

澳大利亚本周通过了禁止 16 岁以下儿童使用社交媒体的法律，它给社媒企业一年时间制定年龄限制计划，违反者将面临最高 5000 万澳元的罚款。科技巨头们纷纷抨击这一禁令。TikTok 警告禁令可能会将年轻用户推向风险更高的在线空间。Meta 质疑该法律的通过过于匆忙，只给它们 24 小时的时间提交意见。Snapchat 母公司 Snap 认为，法律留下了很多未解答的疑问。对于如何实施年龄限制，相关企业不知道如何执行。

This week’s cybersecurity digest highlights multiple critical vulnerabilities and threat actor activities, emphasizing the importance of proactive mitigation strategies. Vulnerabilities […]

The post Weekly Threat Landscape Digest – Week 48 appeared first on HawkEye.

本月玩什么 | 潜行者 2、黄金像凶杀案再起、俄罗斯方块永恒篇等

A vulnerability, which was classified as critical, has been found in Linux Kernel 3.9.0/3.9.1/3.9.2/3.9.3/3.9.4. Affected by this issue is some unknown functionality of the file drivers/net/wireless/b43/main.c. The manipulation of the argument modprobe leads to format string. This vulnerability is handled as CVE-2013-2852. An attack has to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

From a Regular Infostealer to its Obfuscated Version, (Sat, Nov 30th)

A vulnerability classified as critical was found in m1k1o blog. Affected by this vulnerability is the function imagecreatefrom/image. The manipulation leads to improper input validation. This vulnerability is known as CVE-2022-23626. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in ProFTPD 1.2.1. Affected is the function glob of the component Wildcard Character Handler. The manipulation leads to uncontrolled memory allocation. This vulnerability is traded as CVE-2001-1501. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.