Aggregator

A vulnerability has been found in HP BIOS and classified as problematic. This vulnerability affects unknown code. The manipulation leads to time-of-check time-of-use. This vulnerability was named CVE-2022-27541. Access to the local network is required for this attack. There is no exploit available.

A vulnerability was found in Fuji Electric FRENIC RHC Loader 1.1.0.3. It has been classified as critical. Affected is an unknown function of the component FNE File Handler. The manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2023-29160. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability was found in Fuji Electric FRENIC RHC Loader 1.1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component FNE File Handler. The manipulation leads to information disclosure. This vulnerability is known as CVE-2023-29167. The attack needs to be done within the local network. There is no exploit available.

A vulnerability classified as problematic has been found in Fuji Electric FRENIC RHC Loader up to 1.1.0.3. This affects an unknown part of the component Project File Handler. The manipulation leads to xml external entity reference. This vulnerability is uniquely identified as CVE-2023-29498. The attack needs to be approached locally. There is no exploit available.

A vulnerability, which was classified as critical, has been found in TP-LINK TL-WPA8630P 171011. Affected by this issue is the function sub_40A774. The manipulation of the argument key leads to command injection. This vulnerability is handled as CVE-2023-27837. The attack can only be initiated within the local network. There is no exploit available.

A vulnerability has been found in jhead 3.06 and classified as critical. This vulnerability affects the function shellescape of the file jhead.c. The manipulation leads to stack-based buffer overflow. This vulnerability was named CVE-2022-28550. The attack can only be done within the local network. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in TP-Link TL-WPA7510 (EU)_V2_190125. It has been classified as critical. Affected is an unknown function of the file /admin/locale. The manipulation of the argument operation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2023-29562. The attack needs to be done within the local network. There is no exploit available.

A vulnerability, which was classified as critical, was found in Multilaser RE160V and RE163V 12.03.01.09_pt/12.03.01.10_pt. This affects an unknown part of the file /cgi-bin/DownloadCfg/RouterCfm.cfg of the component Web Management Interface. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2023-38944. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Tenable says customers must manually upgrade their software to revive Nessus vulnerability scanner agents taken offline on December 31st due to buggy differential plugin updates. [...]

FireScam malware steals credentials and financial data by monitoring Android app notifications and sending data to a Firebase database. Cybersecurity firm Cyfirma warns of the FireScam Android info-stealing malware that supports spyware capabilities. The malicious code steals credentials and financial data by monitoring app notifications and sending the information to a Firebase database. The malware […]

Weeks after the critical vulnerability was reported and a hacking of the Treasury Department, nearly 9,000 BeyondTrust instances remain wide open to the Internet, researchers say — though it's impossible to tell how many are still vulnerable.

A vulnerability was found in Blahz-DNS 0.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file dostuff.php of the component Authentication. The manipulation leads to improper authentication. This vulnerability is handled as CVE-2002-0599. The attack may be launched remotely. Furthermore, there is an exploit available.

Developers Listed as Public Contact Points Targeted in Phishing Campaign
A supply chain attack that subverted legitimate Google Chrome browser extensions to inject data-stealing malware is more widespread than security researchers first suspected. So far researchers have identified 36 subverted extensions collectively used by 2.6 million people.

Integrity Technology Group Built Botnet for Chinese Hackers, US Treasury Says
The Department of Treasury blacklisted Integrity Technology Group, declaring transactions with the company to be off-limits for U.S. financial institutions and persons. The effect will likely have more symbolic than actual disruptive effect.

iPhone Maker Introduced Feature Without Explicit Consent
Apple's artificial intelligence-led photo analyzer is raising privacy concerns months after the company appears to have enabled the feature by default. It uses a combination of on-device machine learning and encrypted cloud-based processing.

Indiana Attorney General Fines Westend Dental $350K in 2020 Ransomware Hack
An Indiana dental practice agreed to pay the state $350,000 and implement a long list of data security improvements following an alleged 2020 ransomware breach "cover up" that came to light when state regulators investigated a patient complaint about unfulfilled requests for dental X-rays.

Could Advanced Secrets Management be Your Way to Feeling Relieved? Think about it. If you could significantly decrease the likelihood of security breaches and data leaks in your organization, wouldn’t that be a massive weight lifted off your shoulders? But how to systematically fortify your cybersecurity? The answer lies in Non-Human Identities (NHIs) and Secrets […]

The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Entro.

The post Feel Relieved: Advanced Secrets Management Techniques appeared first on Security Boulevard.

Where Does Your Cloud Security Stand? Does your organization’s data management strategy consider non-human identities (NHIs) and secret security management? In the intricate dance of safeguarding data, ensuring the security of machine identities, or NHIs, and their corresponding secrets is pivotal. This practice remains an essential element of best cloud security practices and an effective […]

The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Entro.

The post Ensure Your Data’s Safety: Best Practices in Cloud Security appeared first on Security Boulevard.

Humans are spectacularly bad at predicting the future. Which is why, when someone appears to be able to do it on a regular basis, they are hailed as visionaries, luminaries and celebrated with cool names like Nostradamus and The Amazing Kreskin. Nostradamus made his fame on predictions about the distant future, but that technique has […]

The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Blog.

The post Imperva’s Wildest 2025 AppSec Predictions appeared first on Security Boulevard.