Aggregator

Despite all MITRE has done for cybersecurity, it is clear we should not wait 11 months to discuss the future of the CVE database. It's simply too important for that.

61% of security leaders reported suffering a breach due to failed or misconfigured controls over the past 12 months. This is despite having an average of 43 cybersecurity tools in place. This massive rate of security failure is clearly not a security investment problem. It is a configuration problem. Organizations are beginning to understand that a security control installed or deployed is not

Google Chrome has emerged as the undisputed champion of data collection among 10 popular web browsers studied on the Apple App Store. Collecting a staggering 20 different data types, Chrome surpasses all competitors by a significant margin. From personal contact information and precise financial details-such as payment methods and card numbers-to location data, browsing history, […]

The post Guess Which Browser Tops the List for Data Collection! appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SonicWall has released patches to address three security flaws affecting SMA 100 Secure Mobile Access (SMA) appliances that could be fashioned to result in remote code execution. The vulnerabilities are listed below - CVE-2025-32819 (CVSS score: 8.8) - A vulnerability in SMA100 allows a remote authenticated attacker with SSL-VPN user privileges to bypass the path traversal checks and delete an

A vulnerability was found in libXpm. It has been declared as problematic. This vulnerability affects unknown code of the component XPM Image File Handler. The manipulation leads to resource consumption. This vulnerability was named CVE-2023-43788. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in libXpm. It has been rated as problematic. This issue affects some unknown processing of the component XPM Image File Handler. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2023-43789. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Ghostscript and classified as critical. This vulnerability affects unknown code of the component uniprint Device Handler. The manipulation leads to os command injection. This vulnerability was named CVE-2024-29510. Access to the local network is required for this attack. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Ghostscript. It has been classified as critical. Affected is an unknown function. The manipulation leads to path traversal. This vulnerability is traded as CVE-2024-33870. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Ghostscript and classified as critical. This issue affects some unknown processing. The manipulation leads to path traversal. The identification of this vulnerability is CVE-2024-33869. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in libssh up to 0.9.7/0.10.5 and classified as critical. This vulnerability affects unknown code of the component ProxyCommand/ProxyJump. The manipulation of the argument Hostname leads to code injection. This vulnerability was named CVE-2023-6004. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in Oracle MySQL Server up to 8.0.33. Affected by this issue is some unknown functionality of the component Pluggable Auth. The manipulation leads to information disclosure. This vulnerability is handled as CVE-2023-22048. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, was found in Oracle MySQL Server up to 8.0.33. This affects an unknown part. The manipulation leads to an unknown weakness. This vulnerability is uniquely identified as CVE-2023-22038. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Oracle MySQL Server up to 8.0.33. This affects an unknown part of the component Encryption. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2023-22113. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Oracle MySQL Connectors up to 8.0.33. Affected by this issue is some unknown functionality of the component Connector/C++. The manipulation leads to denial of service. This vulnerability is handled as CVE-2022-4899. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Oracle MySQL Server up to 8.0.33. It has been classified as critical. Affected is an unknown function of the component Compiling. The manipulation leads to denial of service. This vulnerability is traded as CVE-2022-4899. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as critical was found in Oracle SD-WAN Edge 9.1.1.5.0. Affected by this vulnerability is an unknown functionality of the component Internal Tools. The manipulation leads to denial of service. This vulnerability is known as CVE-2022-4899. The attack can be launched remotely. There is no exploit available.

Threat actors with ties to the Qilin ransomware family have leveraged malware known as SmokeLoader along with a previously undocumented .NET compiled loader codenamed NETXLOADER as part of a campaign observed in November 2024. "NETXLOADER is a new .NET-based loader that plays a critical role in cyber attacks," Trend Micro researchers Jacob Santos, Raymart Yambot, John Rainier Navato, Sarah Pearl

Since the start of the year, the Russian state-backed ColdRiver hacking group has been using new LostKeys malware to steal files in espionage attacks targeting Western governments, journalists, think tanks, and non-governmental organizations. [...]

A vulnerability classified as critical has been found in Oracle MySQL Cluster up to 8.0.33. Affected is an unknown function of the component Cluster. The manipulation leads to denial of service. This vulnerability is traded as CVE-2022-4899. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability classified as problematic has been found in zstd 1.4.10. Affected is an unknown function of the component Command Line Handler. The manipulation leads to resource consumption. This vulnerability is traded as CVE-2022-4899. Local access is required to approach this attack. There is no exploit available.