Aggregator

A vulnerability, which was classified as critical, has been found in code-projects Farmacia 1.0. This issue affects some unknown processing of the file /editar-produto.php. The manipulation of the argument id leads to sql injection. The identification of this vulnerability is CVE-2024-11245. The attack may be initiated remotely. Furthermore, there is an exploit available.

A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file reset.php. The manipulation of the argument e leads to sql injection. This vulnerability is known as CVE-2024-11241. The attack can be launched remotely. Furthermore, there is an exploit available.

本文使用ZoomEye平台新升级的增强新语法，基于"行为测绘"理念，针对最近一年时间内网络资产测绘数据进行多维度分析，拓展发现LockBit相关基础设施。

A data breach at an unnamed French hospital exposed the medical records of 750,000 patients after a threat actor gained access to its electronic patient record system. [...]

A vulnerability was found in Linux Kernel up to 6.6.50/6.10.9. It has been rated as critical. This issue affects the function peer_nss. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2024-46827. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.11.3. Affected by this vulnerability is the function ERR_PTR of the file uvc_v4l2.c. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2024-50056. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.56/6.11.3. It has been declared as problematic. Affected by this vulnerability is the function __get_name of the component ntfs3. The manipulation leads to allocation of resources. This vulnerability is known as CVE-2024-50065. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Cisco Identity Services Engine Software. Affected by this vulnerability is an unknown functionality of the component Web-based Management Interface. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-20525. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Cisco Identity Services Engine Software. This affects an unknown part of the component Web-based Management Interface. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-20530. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Google Android. It has been declared as problematic. Affected by this vulnerability is the function DevmemIntChangeSparse of the file devicemem_server.c. The manipulation leads to enforcement of behavioral workflow. This vulnerability is known as CVE-2023-35659. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Google Android. It has been rated as problematic. Affected by this issue is the function PVRSRVRGXKickTA3DKM of the file rgxta3d.c. The manipulation leads to improper input validation. This vulnerability is handled as CVE-2023-35686. The attack needs to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical was found in Google Android. This vulnerability affects the function PMRWritePMPageList of the file pmr.c. The manipulation leads to out-of-bounds write. This vulnerability was named CVE-2024-23715. Local access is required to approach this attack. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Linux Kernel up to 6.1.112/6.6.56/6.11.3 and classified as problematic. This issue affects some unknown processing of the component io_uring. The manipulation leads to state issue. The identification of this vulnerability is CVE-2024-50060. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.1.109/6.6.50/6.10.9. It has been declared as problematic. This vulnerability affects the function kernel.randomize_va_space. The manipulation leads to insufficiently random values. This vulnerability was named CVE-2024-46826. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.10.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component AMD Display. The manipulation of the argument amdgpu_dm leads to improper initialization. This vulnerability is known as CVE-2024-46816. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.10.8. It has been rated as problematic. Affected by this issue is some unknown functionality of the component AMD Display. The manipulation of the argument amdgpu_dm leads to improper initialization. This vulnerability is handled as CVE-2024-46817. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Linux Kernel up to 6.10.8. This vulnerability affects the function amdgpu_irq_put of the component AMD Display. The manipulation leads to state issue. This vulnerability was named CVE-2024-46820. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.50/6.10.9. It has been classified as problematic. This affects the function iwl_mvm_rcu_fw_link_id_to_link_conf of the component iwlwifi. The manipulation leads to Privilege Escalation. This vulnerability is uniquely identified as CVE-2024-46825. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

作者：知道创宇404实验室 日期：2024年11月21日 English version: https://paper.seebug.org/3239/ 一．摘要 LockBit 3.0 是一种知名的勒索软件，由网络犯罪组织通过“勒索软件即服务”（RaaS）模式运作。LockBit 3.0勒索软件联盟是使用该恶意软件进行攻击的独立黑客，他们以分成方式合作。这些成员利用 LockBit 提供的...

研究人员发现，黑客可以通过利用近场通信 (NFC) 大规模套现受害者资金的新技术。  地下论坛上的一篇帖子 该技术由 ThreatFabric 命名为Ghost Tap，可让网络犯罪分子从与 Google Pay 或 Apple Pay 等移动支付服务关联并中继 NFC 流量的被盗信用卡中套现资金。 这家荷兰安全公司称：“犯罪分子现在可以滥用 Google Pay 和 Apple Pay，在几秒钟内将您的点击支付信息传输到全球。”“这意味着即使没有您的实体卡或手机，他们也可以在世界任何地方通过您的账户付款。” 这些攻击通常通过诱骗受害者下载手机银行恶意软件来实施，恶意软件可以使用覆盖攻击或键盘记录器来获取受害者的银行凭证和一次性密码。或者，它可能涉及语音钓鱼组件。 一旦掌握了信用卡详细信息，攻击者就会将信用卡与 Google Pay 或 Apple Pay 关联起来。但为了避免发卡机构封锁信用卡，点击支付信息会被转发给若干名“钱骡”（黑色产业链中负责洗钱或提取现金的人），后者负责在商店进行欺诈性购买。 这是通过一种名为NFCGate的合法研究工具实现的，它可以捕获、分析或修改 NFC 流量。它还可用于通过服务器在两个设备之间传递 NFC 流量。 NFCGate开源项目作者德国达姆施塔特工业大学安全移动网络实验室的研究人员表示：“一台设备作为‘读取器’读取 NFC 标签，另一台设备使用主机卡模拟 (HCE) 模拟 NFC 标签。” 尽管 NFCGate 之前曾被不良行为者使用，将 NFC 信息从受害者的设备传输给攻击者，正如ESET 早在 2024 年 8 月使用 NGate 恶意软件所记录的那样，但最新的进展标志着该工具首次被滥用来传递数据。 ThreatFabric 指出：“网络犯罪分子可以在装有被盗卡的设备和零售商的 PoS [销售点] 终端之间建立中继，保持匿名并进行更大规模的套现。” “持有被盗卡的网络犯罪分子可能远离使用该卡的地点（甚至是不同的国家），也可能在短时间内在多个地点使用同一张卡。” 这种策略的优势在于，它可以用来在线下零售商处购买礼品卡，而网络犯罪分子无需亲自到场。更糟糕的是，它可以被用来在短时间内招募不同地点的多名钱骡，从而扩大欺诈计划的规模。 Ghost Tap攻击的检测难度在于，交易看起来好像来自同一台设备，从而绕过了反欺诈机制。连接卡的设备也可能处于飞行模式，这会使检测其实际位置变得困难，并且很难发现它实际上并未用于在 PoS 终端进行交易。 ThreatFabric 指出：“我们怀疑，随着网络的不断发展，通信速度越来越快，再加上 ATM/POS 终端缺乏适当的基于时间的检测，使得这些攻击成为可能，因为带有卡的实际设备物理上远离进行交易的地点（设备不在 PoS 或 ATM 上）。” “由于能够迅速扩大规模并在匿名的掩护下运作，这种套现方式对金融机构和零售机构都构成了重大挑战。”     转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/334uX_p2THzcfpBuTMjkyA 封面来源于网络，如有侵权请联系删除