Aggregator

A new set of 15 SpyLoan Android malware apps with over 8 million installs was discovered on Google Play, targeting primarily users from South America, Southeast Asia, and Africa. [...]

A vulnerability was found in Apple Mac OS X 10.10/10.10.1. It has been rated as critical. This issue affects some unknown processing of the component bash. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2014-7187. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

澳大利亚本周通过了禁止 16 岁以下儿童使用社交媒体的法律，它给社媒企业一年时间制定年龄限制计划，违反者将面临最高 5000 万澳元的罚款。科技巨头们纷纷抨击这一禁令。TikTok 警告禁令可能会将年轻用户推向风险更高的在线空间。Meta 质疑该法律的通过过于匆忙，只给它们 24 小时的时间提交意见。Snapchat 母公司 Snap 认为，法律留下了很多未解答的疑问。对于如何实施年龄限制，相关企业不知道如何执行。

This week’s cybersecurity digest highlights multiple critical vulnerabilities and threat actor activities, emphasizing the importance of proactive mitigation strategies. Vulnerabilities […]

The post Weekly Threat Landscape Digest – Week 48 appeared first on HawkEye.

本月玩什么 | 潜行者 2、黄金像凶杀案再起、俄罗斯方块永恒篇等

A vulnerability, which was classified as critical, has been found in Linux Kernel 3.9.0/3.9.1/3.9.2/3.9.3/3.9.4. Affected by this issue is some unknown functionality of the file drivers/net/wireless/b43/main.c. The manipulation of the argument modprobe leads to format string. This vulnerability is handled as CVE-2013-2852. An attack has to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

From a Regular Infostealer to its Obfuscated Version, (Sat, Nov 30th)

A vulnerability classified as critical was found in m1k1o blog. Affected by this vulnerability is the function imagecreatefrom/image. The manipulation leads to improper input validation. This vulnerability is known as CVE-2022-23626. The attack can be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Thinking Arts ES.One 1.0. Affected is an unknown function of the file store.cgi. The manipulation of the argument StartID with the input .. leads to path traversal. This vulnerability is traded as CVE-2001-0305. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical has been found in SourceFire Snort 2.1.0/2.1.1 Rc1/2.1.3/2.2. Affected is the function decodetcpoptions of the file decode.c of the component Verbose Mode. The manipulation leads to denial of service. This vulnerability is traded as CVE-2004-2652. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in Jukka Lahtinen Minicom 1.82.0/1.82.1/1.83.0/1.83.1 on Linux. Affected is an unknown function of the component uucp User Handler. The manipulation leads to symlink following. This vulnerability is traded as CVE-2000-0698. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Web-app.org WebAPP 0.9.9/0.9.9.2/0.9.9.2.1. It has been classified as critical. This affects an unknown part of the file apage.cgi. The manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2005-1628. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Name: AlpacaHack Round 7 (Web) (an AlpacaHack event.)
Date: Nov. 30, 2024, 3 a.m. — 30 Nov. 2024, 09:00 UTC  [add to calendar]
Format: Jeopardy
On-line
Offical URL: https://alpacahack.com/ctfs/round-7
Rating weight: 0
Event organizers: AlpacaHack

A vulnerability was found in Apple Safari up to 3.2.3. It has been declared as critical. This vulnerability affects unknown code of the component feed URI Handler. The manipulation leads to memory corruption. This vulnerability was named CVE-2008-3529. The attack can be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Apple Safari up to 3.2.3. It has been rated as critical. This issue affects some unknown processing of the component SVGList Handler. The manipulation leads to memory corruption. The identification of this vulnerability is CVE-2008-3529. The attack may be initiated remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Kenseiboard Kensei Board up to 2.0.0b and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php. The manipulation leads to sql injection. This vulnerability is known as CVE-2009-1853. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in Apple Safari up to 3.2.3. It has been classified as critical. This affects an unknown part in the library libxml of the component XML Handler. The manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2008-3529. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability has been found in Beaussier RoomPHPlanning 1.6 and classified as critical. Affected by this vulnerability is an unknown functionality of the file Login.php. The manipulation leads to improper authentication. This vulnerability is known as CVE-2009-4671. The attack can be launched remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as very critical, has been found in Cisco Mediator Framework up to 2.1. Affected by this issue is some unknown functionality of the component Default Password. The manipulation leads to credentials management. This vulnerability is handled as CVE-2010-0595. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.