#web

More than 225,000 logs containing compromised OpenAI ChatGPT credentials were made available for sale on underground markets between January and October 2023, new findings from Group-IB show. These credentials were found within information stealer logs associated with LummaC2, Raccoon, and RedLine stealer malware. “The number of infected devices decreased slightly in mid- and late

By Deeba Ahmed The CHAVECLOAK banking Trojan employs PDFs, ZIP downloads, DLL sideloading, and deceptive pop-ups to target Brazil's unsuspecting banking users financial sector.  This is a post from HackRead.com Read the original post: New CHAVECLOAK Banking Trojan Targets Brazilians via Malicious PDFs

Windows File Explorer is the is the graphical file management utility for the Windows operating system and the default desktop environment. Windows explorer was introduced… Continue reading → Persistence – Explorer

Windows File Explorer is the is the graphical file management utility for the Windows operating system and the default desktop environment. Windows explorer was introduced… Continue reading → Persistence – Explorer

### Impact _What kind of vulnerability is it? Who is impacted?_ Access to pages is granted regardless of role permissions for webspaces which have a security system configured and permission check enabled. Webspaces without do not have this issue. ### Patches Has the problem been patched? What versions should users upgrade to? The problem is patched with Version `2.4.17` and `2.5.13`. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Remove following lines from `vendor/symfony/security-http/HttpUtils.php`: ``` - // Shortcut if request has already been matched before - if ($request->attributes->has('_route')) { - return $path === $request->attributes->get('_route'); - } ``` Or do not install `symfony/security-http` versions greater equal than `v5.4.30` or `v6.3.6`. ### References _Are there any links users can visit to find out more?_ Currently no references.

By Waqas Another day, another third-party data breach! This is a post from HackRead.com Read the original post: American Express Cardholders Impacted by Third-Party Vendor Data Breach

The transaction, visible on Bitcoin's blockchain, suggests the victim of one of the worst ransomware attacks in years may have paid a very large ransom.

By Deeba Ahmed Leaked Military Audio Raises Stakes in Russia-Ukraine Conflict. This is a post from HackRead.com Read the original post: Russian Operatives Expose German Military Webex Conversations

Gentoo Linux Security Advisory 202403-3 - Multiple vulnerabilities have been discovered in UltraJSON, the worst of which could lead to key confusion and value overwriting. Versions greater than or equal to 5.4.0 are affected.

TP-Link JetStream Smart Switch TL-SG2210P version 5.0 build 20211201 suffers from a privilege escalation vulnerability.