Aggregator

CVE-2024-36572 | allpro form-manager 0.7.4 setDefaults/mergeBranch/Object.setObjectValue prototype pollution

VulDB Recent Entries
3 months 1 week ago
A vulnerability has been found in allpro form-manager 0.7.4 and classified as problematic. Affected by this vulnerability is the function setDefaults/mergeBranch/Object.setObjectValue. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). This vulnerability is known as CVE-2024-36572. The attack needs to be approached within the local network. There is no exploit available.
vuldb.com

CVE-2024-38984 | lukebond json-override 0.2.0 __proto__ prototype pollution

VulDB Recent Entries
3 months 1 week ago
A vulnerability, which was classified as problematic, was found in lukebond json-override 0.2.0. Affected is the function __proto__. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). This vulnerability is traded as CVE-2024-38984. Access to the local network is required for this attack to succeed. There is no exploit available.
vuldb.com

CVE-2024-37281 | Elastic Kibana up to 7.17.22/8.13.x Requests resource consumption

VulDB Recent Entries
3 months 1 week ago
A vulnerability, which was classified as critical, has been found in Elastic Kibana up to 7.17.22/8.13.x. This issue affects some unknown processing of the component Requests Handler. The manipulation leads to resource consumption. The identification of this vulnerability is CVE-2024-37281. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2024-39011 | chargeover redoc 2.0.9-rc.69 mergeObjects prototype pollution

VulDB Recent Entries
3 months 1 week ago
A vulnerability was found in chargeover redoc 2.0.9-rc.69. It has been rated as problematic. Affected by this issue is the function mergeObjects. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). This vulnerability is handled as CVE-2024-39011. The attack can only be initiated within the local network. There is no exploit available.
vuldb.com

CVE-2024-39012 | ais-ltd strategyen 0.4.0 mergeObjects prototype pollution

VulDB Recent Entries
3 months 1 week ago
A vulnerability was found in ais-ltd strategyen 0.4.0. It has been classified as problematic. Affected is the function mergeObjects. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). This vulnerability is traded as CVE-2024-39012. The attack needs to be approached within the local network. There is no exploit available.
vuldb.com

CVE-2024-6255 | gaizhenbiao ChuanhuChatGPT up to 20240410 JSON File config.json file inclusion

VulDB Recent Entries
3 months 1 week ago
A vulnerability was found in gaizhenbiao ChuanhuChatGPT up to 20240410 and classified as critical. This issue affects some unknown processing of the file config.json of the component JSON File Handler. The manipulation leads to file inclusion. The identification of this vulnerability is CVE-2024-6255. The attack may be initiated remotely. There is no exploit available.
vuldb.com

CVE-2024-38983 | alykoshin mini-deep-assign 0.0.8 /lib/index.js _assign prototype pollution

VulDB Recent Entries
3 months 1 week ago
A vulnerability has been found in alykoshin mini-deep-assign 0.0.8 and classified as problematic. This vulnerability affects the function _assign in the library /lib/index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). This vulnerability was named CVE-2024-38983. The attack can be initiated remotely. There is no exploit available.
vuldb.com

CVE-2024-38986 | 75lb deep-merge 1.1.1 Merge Method prototype pollution

VulDB Recent Entries
3 months 1 week ago
A vulnerability, which was classified as problematic, was found in 75lb deep-merge 1.1.1. This affects an unknown part of the component Merge Method Handler. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). This vulnerability is uniquely identified as CVE-2024-38986. The attack needs to be initiated within the local network. There is no exploit available.
vuldb.com

CVE-2024-39010 | chase-moskal snapstate 0.0.9 attemptNestedProperty prototype pollution

VulDB Recent Entries
3 months 1 week ago
A vulnerability, which was classified as problematic, has been found in chase-moskal snapstate 0.0.9. Affected by this issue is the function attemptNestedProperty. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). This vulnerability is handled as CVE-2024-39010. The attack needs to be done within the local network. There is no exploit available.
vuldb.com

CVE-2024-41945 | FuelLabs fuels-ts up to 0.92.x account.ts fund access control (GHSA-3jcg-vx7f-j6qf)

VulDB Recent Entries
3 months 1 week ago
A vulnerability classified as problematic was found in FuelLabs fuels-ts up to 0.92.x. Affected by this vulnerability is the function fund of the file fuels-ts/packages/account/src/account.ts. The manipulation leads to improper access controls. This vulnerability is known as CVE-2024-41945. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2023-33976 | Google TensorFlow up to 2.12.x array_ops.upper_bound integer overflow (GHSA-gjh7-xx4r-x345)

VulDB Recent Entries
3 months 1 week ago
A vulnerability classified as problematic has been found in Google TensorFlow up to 2.12.x. Affected is the function array_ops.upper_bound. The manipulation leads to integer overflow. This vulnerability is traded as CVE-2023-33976. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com

Android 间谍软件“Mandrake”自 2022 年以来就隐藏在 Google Play 中

嘶吼
3 months 1 week ago

Bitdefender 于 2020 年首次记录了 Android 间谍软件“Mandrake”，研究人员强调了该恶意软件复杂的间谍功能，并指出它至少从 2016 年开始就在野外运行。

卡巴斯基最近报告称，具有更好的混淆和规避功能的 Mandrake 新变种已经通过 2022 年提交给 Google Play 的五个应用程序潜入进来。

这些应用程序至少持续可用一年，而最后一个应用程序 AirFS（在受欢迎程度和感染率方面较为突出）于 2024 年 3 月底被删除。

Google Play 上的 AirFS

卡巴斯基确定了五款携带 Mandrake 的应用程序如下：

· AirFS – it9042 通过 Wi-Fi 共享文件（2022 年 4 月 28 日至 2024 年 3 月 15 日期间下载量为 30,305 次）

· Astro Explorer 来自 shevabad（2022 年 5 月 30 日至 2023 年 6 月 6 日期间下载量为 718 次）

· Amber 来自 kodaslda （2022 年 2 月 27 日至 2023 年 8 月 19 日期间下载量为 19 次）

· CryptoPulsing 来自 shevabad（2022 年 11 月 2 日至 2023 年 6 月 6 日期间下载量为 790 次）

·Brain Matrix 来自 kodaslda（2022 年 4 月 27 日至 2023 年 6 月 6 日期间下载量为 259 次）

该网络安全公司表示，大多数下载来自加拿大、德国、意大利、墨西哥、西班牙、秘鲁和英国。

四款应用将 Mandrake 恶意软件植入受害者设备

逃避侦查

与将恶意逻辑放置在应用程序的 DEX 文件中的典型 Android 恶意软件不同，Mandrake 将其初始阶段隐藏在本机库“libopencv_dnn.so”中，该库使用 OLLVM 进行大量混淆。

在恶意应用程序安装后，该库会导出函数以从其资产文件夹解密第二阶段加载器 DEX 并将其加载到内存中。

第二阶段请求绘制覆盖的权限并加载第二个本机库“libopencv_java3.so”，该库解密证书以便与命令和控制（C2）服务器进行安全通信。

与 C2 建立通信后，该应用程序会发送设备配置文件，并在认为合适时接收核心 Mandrake 组件（第三阶段）。一旦激活核心组件，Mandrake 间谍软件就可以执行各种恶意活动，包括数据收集、屏幕录制和监控、命令执行、模拟用户滑动和点击、文件管理和应用程序安装。

值得注意的是，威胁者可以通过显示模仿 Google Play 的通知来提示用户安装更多恶意 APK，诱骗用户通过看似可信的过程安装不安全的文件。

卡巴斯基表示，该恶意软件还使用基于会话的安装方法来绕过 Android 13（及更高版本）对非官方来源 APK 安装的限制。

与其他 Android 恶意软件一样，Mandrake 可以要求用户授予在后台运行的权限，并在受害者的设备上隐藏植入程序应用程序的图标，从而秘密运行。

该恶意软件的最新版本还具有逃避攻击的功能，可在 Frida（一种在安全分析师中流行的动态检测工具包）中存在。

它还检查设备根状态，搜索与其相关的特定二进制文件，验证系统分区是否以只读方式安装，并检查设备上是否启用了开发设置和 ADB。

Mandrake 威胁仍然存在，尽管卡巴斯基认定为植入程序的五款应用已不再在 Google Play 上提供，但该恶意软件可能会通过新的、更难检测的应用卷土重来。

建议 Android 用户仅安装来自信誉良好的发行商的应用，在安装前查看用户评论，避免授予与应用功能无关的危险权限请求，并确保 Play Protect 始终处于活动状态。

Google 也分享了有关在 Google Play 上发现恶意应用的声明表示，Google Play Protect 会自动保护 Android 用户免受已知版本的恶意软件侵害，该功能在安装有 Google Play 服务的 Android 设备上默认启用。Google Play Protect 可以警告用户或阻止已知表现出恶意行为的应用程序，即使这些应用程序来自 Play 以外的来源。

胡金鱼

Record-breaking Ransom Payment: Dark Angels Ransomware Received $75 Million

Cyber Security News
3 months 1 week ago

Cybersecurity firm Zscaler has revealed that the Dark Angels ransomware group received an unprecedented $75 million ransom payment from a single victim in a shocking development that underscores the escalating ransomware threat. This staggering sum nearly doubles the $40 million paid by insurance giant CNA Financial in 2021, marking a new milestone in the history […]

The post Record-breaking Ransom Payment: Dark Angels Ransomware Received $75 Million appeared first on Cyber Security News.

Guru Baran

Managed ad