#ssl

Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.

By Owais Sultan In today’s digital age, the use of the internet has become an integral part of our lives. Whether… This is a post from HackRead.com Read the original post: Understand the Evolution of Captive Portal to Cloud Authentication Solutions

Shorter certificate lifespans are beneficial, but they require a rethink of how to properly manage them.

Ubuntu Security Notice 6094-1 - Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a denial of service. Jordy Zomer and Alexandra Sandulescu discovered that the Linux kernel did not properly implement speculative execution barriers in usercopy functions in certain situations. A local attacker could use this to expose sensitive information.

Ubuntu Security Notice 6096-1 - It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information. Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service.

Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.

1. EXECUTIVE SUMMARY CVSS v3 9.8  ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: RTU500 Series Vulnerabilities: Type Confusion, Observable Timing Discrepancy, Out-of-bounds Read, Infinite Loop, Classic Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to crash the device being accessed or cause a denial-of-service condition.   3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Hitachi Energy’s RTU500 Series Product, are affected:  For CVE-2023-0286, CVE-2022-4304   RTU500 series CMU Firmware: version 12.0.1 through 12.0.15  RTU500 series CMU Firmware: version 12.2.1 through 12.2.12   RTU500 series CMU Firmware: version 12.4.1 through 12.4.12   RTU500 series CMU Firmware: version 12.6.1 through 12.6.9   RTU500 series CMU Firmware: version 12.7.1 through 12.7.6   RTU500 series CMU Firmware: version 13.2.1 through 13.2.6   RTU500 series CMU Firmware: version 13.3.1 through ...

Categories: Threat Intelligence Tags: malvertising Tags: google Tags: ads Tags: amazon Tags: cloaking Ads containing the official website of an impersonated brand are running again, allowing fraudsters to scam users. (Read more...) The post Malvertising via brand impersonation is back again appeared first on Malwarebytes Labs.

Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.

Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator-agent v7+ may override other users syslog drain credentials if they're aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and add or modify a certificate authority used for the connection.