About FreshRSS

There are new available articles, click to refresh the page.

Before yesterdayFull Disclosure

Full Disclosure
Wordpress plugin - WPvivid Backup - CVE-2022-2863.
October 3^rd 2022 at 15:12

Wordpress plugin - WPvivid Backup - CVE-2022-2863.

Posted by Rodolfo Tavares via Fulldisclosure on Oct 03

=====[ Tempest Security Intelligence - ADV-15/2022
]==========================

Wordpress plugin - WPvivid Backup - Version < 0.9.76

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Vulnerability...

October 3^rd 2022 at 15:12

Full Disclosure
Backdoor.Win32.NTRC / Weak Hardcoded Credentials
October 3^rd 2022 at 15:12

Backdoor.Win32.NTRC / Weak Hardcoded Credentials

Posted by malvuln on Oct 03

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/273fd3f33279cc9c0378a49cf63d7a06.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.NTRC
Vulnerability: Weak Hardcoded Credentials
Family: NTRC
Type: PE32
MD5: 273fd3f33279cc9c0378a49cf63d7a06
Vuln ID: MVID-2022-0646
Disclosure: 10/02/2022
Description: The malware listens on TCP port 6767....

October 3^rd 2022 at 15:12

Full Disclosure
Backdoor.Win32.Delf.eg / Unauthenticated Remote Command Execution
October 3^rd 2022 at 15:12

Backdoor.Win32.Delf.eg / Unauthenticated Remote Command Execution

Posted by malvuln on Oct 03

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/de6220a8e8fcbbee9763fb10e0ca23d7.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Delf.eg
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 7401. Third-party adversarys
who can reach infected systems can issue commands made available by the...

October 3^rd 2022 at 15:12

Full Disclosure
ZKBiosecurity - Authenticated SQL Injection resulting in RCE (CVE-2022-36635)
October 1^st 2022 at 06:27

ZKBiosecurity - Authenticated SQL Injection resulting in RCE (CVE-2022-36635)

Posted by Caio B on Sep 30

#######################ADVISORY INFORMATION#######################

Product: ZKSecurity BIO

Vendor: ZKTeco (
https://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurity_V5000_4.1.2)

Version Affected: 4.1.2

CVE: CVE-2022-36635

Vulnerability: SQL Injection (with a plus: RCE)

#######################CREDIT#######################

This vulnerability was discovered and researched by Caio Burgardt and
Silton Santos....

October 1^st 2022 at 06:27

Full Disclosure
ZKBioSecurity 3.0.5- Privilege Escalation to Admin (CVE-2022-36634)
October 1^st 2022 at 06:27

ZKBioSecurity 3.0.5- Privilege Escalation to Admin (CVE-2022-36634)

Posted by Caio B on Sep 30

#######################ADVISORY INFORMATION#######################

Product: ZKSecurity BIO

Vendor: ZKTeco

Version Affected: 3.0.5.0_R

CVE: CVE-2022-36634

Vulnerability: User privilege escalation

#######################CREDIT#######################

This vulnerability was discovered and researched by Caio Burgardt and
Silton Santos.

#######################INTRODUCTION#######################

Based on the hybrid biometric technology and...

October 1^st 2022 at 06:27

Full Disclosure
SEC Consult SA-20220923-0 :: Multiple Memory Corruption Vulnerabilities in COVESA (Connected Vehicle Systems Alliance) DLT daemon
September 27^th 2022 at 11:18

SEC Consult SA-20220923-0 :: Multiple Memory Corruption Vulnerabilities in COVESA (Connected Vehicle Systems Alliance) DLT daemon

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 27

SEC Consult Vulnerability Lab Security Advisory < 20220923-0 >
=======================================================================
title: Multiple Memory Corruption Vulnerabilities
product: COVESA DLT daemon (Diagnostic Log and Trace)
Connected Vehicle Systems Alliance (COVESA), formerly GENIVI
vulnerable version: <= 2.18.8
fixed version: current master branch commit...

September 27^th 2022 at 11:18

Full Disclosure
Backdoor.Win32.Bingle.b / Weak Hardcoded Credentials
September 27^th 2022 at 11:18

Backdoor.Win32.Bingle.b / Weak Hardcoded Credentials

Posted by malvuln on Sep 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/eacaa12336f50f1c395663fba92a4d32.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Bingle.b
Vulnerability: Weak Hardcoded Credentials
Description: The malware is packed using ASPack 2.11, listens on TCP port
22 and requires authentication. However, the password "let me in" is weak
and...

September 27^th 2022 at 11:18

Full Disclosure
Backdoor.Win32.Psychward.b / Weak Hardcoded Credentials
September 27^th 2022 at 11:18

Backdoor.Win32.Psychward.b / Weak Hardcoded Credentials

Posted by malvuln on Sep 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/0b8cf90ab9820cb3fcb7f1d1b45e4e57.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Psychward.b
Vulnerability: Weak Hardcoded Credentials
Description: The malware listens on TCP port 8888 and requires
authentication. However, the password "4174" is weak and hardcoded in
cleartext within the PE...

September 27^th 2022 at 11:18

Full Disclosure
Backdoor.Win32.Augudor.b / Remote File Write Code Execution
September 27^th 2022 at 11:18

Backdoor.Win32.Augudor.b / Remote File Write Code Execution

Posted by malvuln on Sep 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/94ccd337cbdd4efbbcc0a6c888abb87d.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Augudor.b
Vulnerability: Remote File Write Code Execution
Description: The malware drops an empty file named "zy.exe" and listens on
TCP port 810. Third-party adversaries who can reach the infected host can...

September 27^th 2022 at 11:18

Full Disclosure
Backdoor.Win32.Hellza.120 / Unauthorized Remote Command Execution
September 20^th 2022 at 00:30

Backdoor.Win32.Hellza.120 / Unauthorized Remote Command Execution

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hellza.120
Vulnerability: Unauthorized Remote Command Execution
Description: The malware listens on TCP ports 12122, 21. Third-party
adversarys who can reach infected systems can issue commands made available
by the...

September 20^th 2022 at 00:30

Full Disclosure
Trojan-Dropper.Win32.Corty.10 / Insecure Credential Storage
September 20^th 2022 at 00:30

Trojan-Dropper.Win32.Corty.10 / Insecure Credential Storage

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Corty.10
Vulnerability: Insecure Credential Storage
Description: The malware stores its credentials in cleartext within the
Windows registry.
Family: Corty
Type: PE32
MD5: f72138e574743640bdcdb9f102dff0a5
Vuln ID:...

September 20^th 2022 at 00:30

Full Disclosure
Trojan.Ransom.Ryuk.A / Arbitrary Code Execution
September 20^th 2022 at 00:30

Trojan.Ransom.Ryuk.A / Arbitrary Code Execution

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/5ac0f050f93f86e69026faea1fbb4450.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Ransom.Ryuk.A
Vulnerability: Arbitrary Code Execution
Description: The ransomware looks for and executes DLLs in its current
directory. Therefore, we can potentially hijack a vuln DLL execute our own
code, control and terminate...

September 20^th 2022 at 00:30

Full Disclosure
Backdoor.Win32.Hellza.120 / Authentication Bypass
September 20^th 2022 at 00:30

Backdoor.Win32.Hellza.120 / Authentication Bypass

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hellza.120
Vulnerability: Authentication Bypass
Description: The malware listens on TCP ports 12122, 21. Third-party
adversarys who can reach infected systems can logon using any
username/password combination....

September 20^th 2022 at 00:30

Full Disclosure
Re: over 2000 packages depend on abort()ing libgmp
September 20^th 2022 at 00:28

Re: over 2000 packages depend on abort()ing libgmp

Posted by Matthew Fernandez on Sep 19

What is the security boundary being violated here? As a maintainer of
some of the packages implicated here, I’m unsure what my actionable
tasks are. The threat model(s) for my packages does not consider crashes
to be a security violation. On the other side, things like crypto code
frequently use their own non-GMP implementation of bignum arith for this
(and other) reason.

Not trying to brush this off. But I’m just trying to gain an...

September 20^th 2022 at 00:28

Full Disclosure
SEC Consult SA-20220914-0 :: Improper Access Control in SAP® SAProuter
September 16^th 2022 at 03:30

SEC Consult SA-20220914-0 :: Improper Access Control in SAP® SAProuter

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15

SEC Consult Vulnerability Lab Security Advisory < 20220914-0 >
=======================================================================
title: Improper Access Control
product: SAP® SAProuter
vulnerable version: see section "Vulnerable / tested versions"
fixed version: see SAP security note 3158375
CVE number: CVE-2022-27668
impact: high
homepage:...

September 16^th 2022 at 03:30

Full Disclosure
SEC Consult SA-20220915-0 :: Local Privilege Escalation im SAP® SAPControl Web Service Interface (sapuxuserchk)
September 16^th 2022 at 03:30

SEC Consult SA-20220915-0 :: Local Privilege Escalation im SAP® SAPControl Web Service Interface (sapuxuserchk)

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15

SEC Consult Vulnerability Lab Security Advisory < 20220915-0 >
=======================================================================
title: Local privilege escalation
product: SAP® SAPControl Web Service Interface (sapuxuserchk)
vulnerable version: see section "Vulnerable / tested versions"
fixed version: see SAP security note 3158619
CVE number: CVE-2022-29614...

September 16^th 2022 at 03:30

Full Disclosure
over 2000 packages depend on abort()ing libgmp
September 16^th 2022 at 03:29

over 2000 packages depend on abort()ing libgmp

Posted by Georgi Guninski on Sep 15

ping world

libgmp is library about big numbers.

it is not a library for very big numbers, because
if libgmp meets a very big number, it calls abort()
and coredumps.

2442 packages depend on libgmp on ubuntu20.

guest3@ubuntu20:~/prim$ apt-cache rdepends libgmp10 | wc -l
2442

gawk crash:

guest3@ubuntu20:~/prim$ gawk --bignum 'BEGIN { a = 2 ^ 2 ^41; print "a =", a }'
gmp: overflow in mpz type
Aborted (core dumped)...

September 16^th 2022 at 03:29

Full Disclosure
APPLE-SA-2022-09-12-4 macOS Monterey 12.6
September 12^th 2022 at 19:07

APPLE-SA-2022-09-12-4 macOS Monterey 12.6

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-4 macOS Monterey 12.6

macOS Monterey 12.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213444.

ATS
Available for: macOS Monterey
Impact: An app may be able to bypass Privacy preferences
Description: A logic issue was addressed with improved state
management.
CVE-2022-32902: Mickey Jin (@patch1t)

iMovie
Available for: macOS Monterey
Impact: A user may...

September 12^th 2022 at 19:07

Full Disclosure
APPLE-SA-2022-09-12-1 iOS 16
September 12^th 2022 at 19:07

APPLE-SA-2022-09-12-1 iOS 16

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-1 iOS 16

iOS 16 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213446.

Additional CVE entries to be added soon.

Contacts
Available for: iPhone 8 and later
Impact: An app may be able to bypass Privacy preferences
Description: This issue was addressed with improved checks.
CVE-2022-32854: Holger Fuhrmannek of Deutsche Telekom Security

Kernel
Available...

September 12^th 2022 at 19:07

Full Disclosure
APPLE-SA-2022-09-12-2 iOS 15.7 and iPadOS 15.7
September 12^th 2022 at 19:07

APPLE-SA-2022-09-12-2 iOS 15.7 and iPadOS 15.7

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-2 iOS 15.7 and iPadOS 15.7

iOS 15.7 and iPadOS 15.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213445.

Contacts
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2
and later, iPad 5th generation and later, iPad mini 4 and later, and
iPod touch (7th generation)
Impact: An app may be able to bypass Privacy preferences
Description:...

September 12^th 2022 at 19:07

Full Disclosure
APPLE-SA-2022-09-12-5 Safari 16
September 12^th 2022 at 19:07

APPLE-SA-2022-09-12-5 Safari 16

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-5 Safari 16

Safari 16 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213442.

Safari Extensions
Available for: macOS Big Sur and macOS Monterey
Impact: A website may be able to track users through Safari web
extensions
Description: A logic issue was addressed with improved state
management.
WebKit Bugzilla: 242278
CVE-2022-32868: Michael

WebKit...

September 12^th 2022 at 19:07

Full Disclosure
Multiple vulnerabilities discovered in Qualys Cloud Agent
September 12^th 2022 at 19:06

Multiple vulnerabilities discovered in Qualys Cloud Agent

Posted by Daniel Wood via Fulldisclosure on Sep 12

The Unqork Security team discovered multiple security vulnerabilities in
the Qualys Cloud Agent, to include arbitrary code execution.

CVE-2022-29549 (Arbitrary Code Execution)
https://nvd.nist.gov/vuln/detail/CVE-2022-29549

CVE-2022-29550 (Sensitive Information Disclosure)
https://nvd.nist.gov/vuln/detail/CVE-2022-29550

Read more:
https://www.unqork.com/resources/unqork-and-qualys-partner-to-resolve-zero-day-vulnerabilities...

September 12^th 2022 at 19:06

Full Disclosure
[SYSS-2022-041] Remote Code Execution due to unsafe JMX default configuration in JasperReports Server
September 12^th 2022 at 19:06

[SYSS-2022-041] Remote Code Execution due to unsafe JMX default configuration in JasperReports Server

Posted by Moritz Bechler on Sep 12

Advisory ID: SYSS-2022-041
Product: JasperReports Server
Manufacturer: TIBCO Software Inc.
Tested Version(s): 8.0.2 Community Edition
Vulnerability Type: CWE-502: Deserialization of Untrusted Data
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2022-06-10
Solution Date: 2022-08-10
Public Disclosure: 2022-09-09
CVE Reference:...

September 12^th 2022 at 19:06

Full Disclosure
Trojan.Win32.Autoit.fhj / Named Pipe Null DACL
September 9^th 2022 at 03:25

Trojan.Win32.Autoit.fhj / Named Pipe Null DACL

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/d871836f77076eeed87eb0078c1911c7_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Autoit.fhj
Vulnerability: Named Pipe Null DACL
Family: Autoit
Type: PE32
MD5: d871836f77076eeed87eb0078c1911c7
Vuln ID: MVID-2022-0638
Disclosure: 09/06/2022
Description: The malware creates two processes...

September 9^th 2022 at 03:25

Full Disclosure
Trojan.Win32.Autoit.fhj / Insecure Permissions
September 9^th 2022 at 03:25

Trojan.Win32.Autoit.fhj / Insecure Permissions

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/d871836f77076eeed87eb0078c1911c7.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Autoit.fhj
Vulnerability: Insecure Permissions
Description: The malware writes two hidden DLL files "vp8decoder.dll" and
"vp8encoder.dll" to its installation directory granting full (F)
permissions to...

September 9^th 2022 at 03:25

Full Disclosure
Backdoor.Win32.Winshell.5_0 / Weak Hardcoded Credentials
September 9^th 2022 at 03:25

Backdoor.Win32.Winshell.5_0 / Weak Hardcoded Credentials

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/5bc5f72d19019a2fa3b75896e82ae1e5.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Winshell.5_0
Vulnerability: Weak Hardcoded Credentials
Description: The malware is UPX packed, listens on TCP port 5277 and
requires authentication for remote access. However, the password
"123456789" is weak...

September 9^th 2022 at 03:25

Full Disclosure
Backdoor.Win32.Hupigon.aspg / Insecure Service Path
September 9^th 2022 at 03:25

Backdoor.Win32.Hupigon.aspg / Insecure Service Path

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/121bf601275e2aed0c3a6fe7910f9826.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hupigon.aspg
Vulnerability: Insecure Service Path
Description: The malware creates a service with an unquoted path. Attackers
who can place an arbitrary executable named "Program.exe" under c:\ drive
can...

September 9^th 2022 at 03:25

Full Disclosure
Trojan-Spy.Win32.Pophot.bsl / Insecure Permissions
September 9^th 2022 at 03:25

Trojan-Spy.Win32.Pophot.bsl / Insecure Permissions

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/8c0e6ec6b8ac9eb1169e63df71f24456.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Spy.Win32.Pophot.bsl
Vulnerability: Insecure Permissions
Description: The malware writes a BATCH file ".bat" to c drive granting
change (C) permissions to the authenticated user group. Standard users can
rename the...

September 9^th 2022 at 03:25

Full Disclosure
Trojan-Ransom.Win32.Hive.bv / Arbitrary Code Execution
September 9^th 2022 at 03:25

Trojan-Ransom.Win32.Hive.bv / Arbitrary Code Execution

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/44aba241dd3f0d156c6ed82a0ab3a9e1.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Ransom.Win32.Hive.bv
Vulnerability: Arbitrary Code Execution
Description: Hive Ransomware will load and execute arbitrary .EXE PE files
if a third-party adversary or defender uses the vulnerable naming
convention of...

September 9^th 2022 at 03:25

Full Disclosure
sagemath denial of service with abort() in gmp: overflow in mpz type
September 9^th 2022 at 03:24

sagemath denial of service with abort() in gmp: overflow in mpz type

Posted by Georgi Guninski on Sep 08

sagemath 9.0 and reportedly later on ubuntu 20.

sagemath gives access to the python interpreter,
so code execution is trivial.

We give DoS attacks, which terminates the sagemath process
with abort(), when raising symbolic expression to large integer power.

We get abort() with stack:

gmp: overflow in mpz type

#6 0x00007f55c83ee72e in __GI_abort () at
/build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79
#7 0x00007f55c56e0d20 in __gmpz_realloc ()...

September 9^th 2022 at 03:24

Full Disclosure
AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal
September 9^th 2022 at 03:24

AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal

Posted by Jens Regel | CRISEC on Sep 08

Title:
======
AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal

Author:
=======
Jens Regel, CRISEC IT-Security

CVE:
====
CVE-2022-23854

Advisory:
=========
https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal/

Timeline:
=========
25.06.2021 Vulnerability discovered
25.06.2021 Send details to custfirstsupport () aveva com
21.09.2021 Vendor response, fix is available until Q1/2022
25.09.2021 Vendor...

September 9^th 2022 at 03:24

Full Disclosure
123ADV-001: Stack Buffer Overflow in Lotus 1-2-3 R3 for UNIX/Linux
September 6^th 2022 at 02:59

123ADV-001: Stack Buffer Overflow in Lotus 1-2-3 R3 for UNIX/Linux

Posted by Tavis Ormandy on Sep 05

# About

The 123 command is a spreadsheet application for UNIX-based systems that
can be used in interactive mode to create and modify financial and
scientific models.

For more information, see https://123r3.net

# Advisory

A stack buffer overflow was reported in the cell format processing
routines. If a victim opens an untrusted malicious worksheet, code
execution could occur.

There have been no reports of this vulnerability being exploited...

September 6^th 2022 at 02:59

Full Disclosure
Open-Xchange Security Advisory 2022-09-01
September 2^nd 2022 at 03:40

Open-Xchange Security Advisory 2022-09-01

Posted by Martin Heiland via Fulldisclosure on Sep 01

Dear subscribers,

we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Product: OX App Suite
Vendor: OX Software GmbH

Internal reference: MWB-1540
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable...

September 2^nd 2022 at 03:40

Full Disclosure
APPLE-SA-2022-08-31-1 iOS 12.5.6
September 1^st 2022 at 01:40

APPLE-SA-2022-08-31-1 iOS 12.5.6

Posted by Apple Product Security via Fulldisclosure on Aug 31

APPLE-SA-2022-08-31-1 iOS 12.5.6

iOS 12.5.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213428.

iOS 12 is not impacted by CVE-2022-32894.

WebKit
Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad
mini 2, iPad mini 3, and iPod touch (6th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of...

September 1^st 2022 at 01:40

Full Disclosure
Re: typeorm CVE-2022-33171
August 19^th 2022 at 17:02

Re: typeorm CVE-2022-33171

Posted by Tobias Schneider on Aug 19

Someone should tell Snyk about the risks of "Supply Chain vulnerabilities"
...

(and yes this is a vulnerability, nice find!)

LoL'ing at Maintainer.

Cheers, @haxel0rd.

August 19^th 2022 at 17:02

Full Disclosure
APPLE-SA-2022-08-17-1 iOS 15.6.1 and iPadOS 15.6.1
August 19^th 2022 at 17:01

APPLE-SA-2022-08-17-1 iOS 15.6.1 and iPadOS 15.6.1

Posted by Apple Product Security via Fulldisclosure on Aug 19

APPLE-SA-2022-08-17-1 iOS 15.6.1 and iPadOS 15.6.1

iOS 15.6.1 and iPadOS 15.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213412.

Kernel
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2
and later, iPad 5th generation and later, iPad mini 4 and later, and
iPod touch (7th generation)
Impact: An application may be able to execute arbitrary code with...

August 19^th 2022 at 17:01

Full Disclosure
APPLE-SA-2022-08-17-2 macOS Monterey 12.5.1
August 19^th 2022 at 17:01

APPLE-SA-2022-08-17-2 macOS Monterey 12.5.1

Posted by Apple Product Security via Fulldisclosure on Aug 19

APPLE-SA-2022-08-17-2 macOS Monterey 12.5.1

macOS Monterey 12.5.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213413.

Kernel
Available for: macOS Monterey
Impact: An application may be able to execute arbitrary code with
kernel privileges. Apple is aware of a report that this issue may
have been actively exploited.
Description: An out-of-bounds write issue was addressed...

August 19^th 2022 at 17:01

Full Disclosure
[CVE-2022-2536] Transposh <= 1.0.8.1 “tp_translation” Authorization Bypass
August 19^th 2022 at 17:01

[CVE-2022-2536] Transposh <= 1.0.8.1 “tp_translation” Authorization Bypass

Posted by Julien Ahrens (RCE Security) on Aug 19

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Transposh WordPress Translation
Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type: Incorrect Authorization [CWE-863]
Date found: 2022-07-23
Date published: 2022-08-16
CVSSv3 Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVE: CVE-2022-2536

2. CREDITS...

August 19^th 2022 at 17:01

APPLE-SA-2022-08-18-1 Safari 15.6.1

Posted by Apple Product Security via Fulldisclosure on Aug 19

APPLE-SA-2022-08-18-1 Safari 15.6.1

Safari 15.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213414.

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been actively exploited.
Description: An out-of-bounds write issue was...

August 19^th 2022 at 17:01

Full Disclosure
Trovent Security Advisory 2110-01 / Insecure data storage in Polar Flow Android application
August 19^th 2022 at 17:01

Trovent Security Advisory 2110-01 / Insecure data storage in Polar Flow Android application

Posted by Stefan Pietsch on Aug 19

# Trovent Security Advisory 2110-01 #
#####################################

Insecure data storage in Polar Flow Android application
#######################################################

Overview
########

Advisory ID: TRSA-2110-01
Advisory version: 1.0
Advisory status: Public
Advisory URL: https://trovent.io/security-advisory-2110-01
Affected product: Polar Flow Android mobile application (fi.polar.polarflow)
Affected version: 5.7.1
Vendor:...

August 19^th 2022 at 17:01

Full Disclosure
Zyxel IPC 3605N & 4605N / Remote shell access
August 16^th 2022 at 03:32

Zyxel IPC 3605N & 4605N / Remote shell access

Posted by Eric Urban on Aug 15

Hello everyone,

I have identified that the Zyxel IPC 3605N and 4605N IP based security
cameras have multiple flaws. Combining these together leads to the ability
for an attacker to remotely install root shell access on the device.

A web server installed for UPnP purposes allows the plaintext passwords to
be retrieved by anyone. This grants access to the web administration
interface. From there, a tarball can be downloaded, modified with a...

August 16^th 2022 at 03:32

Full Disclosure
Re: typeorm CVE-2022-33171
August 16^th 2022 at 03:32

Re: typeorm CVE-2022-33171

Posted by Andrii Kostenko via Fulldisclosure on Aug 15

I found what I think is a vulnerability in the latest typeorm 0.3.7.
TypeORM v0.3 has a new findOneBy method instead of findOneById() and it is
the only way to get a record by id

Sending undefined as a value in this method removes this parameter from the
query. This leads to the data exposure.

For example:
Users.findOneBy({id: req.query.id}) with /?id=12345 produces SELECT * FROM
Users WHERE id=12345 LIMIT 1 while removing id from the query...

August 16^th 2022 at 03:32

Full Disclosure
Win32.Ransom.BlueSky / Arbitrary Code Execution
August 16^th 2022 at 03:32

Win32.Ransom.BlueSky / Arbitrary Code Execution

Posted by malvuln on Aug 15

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/961fa85207cdc4ef86a076bbff07a409.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Win32.Ransom.BlueSky
Vulnerability: Arbitrary Code Execution
Description: The BlueSky ransomware looks for and executes arbitrary DLLs
in its current working directory. Therefore, we can hijack a vuln DLL,
execute our own code, control...

August 16^th 2022 at 03:32

Full Disclosure
CVE-2022-2590: Linux kernel privilege escalation vulnerability
August 12^th 2022 at 01:57

CVE-2022-2590: Linux kernel privilege escalation vulnerability

Posted by Turritopsis Dohrnii Teo En Ming on Aug 11

Subject: CVE-2022-2590: Linux kernel privilege escalation vulnerability

Good day from Singapore,

Just sharing this Linux kernel security vulnerability.

Article: CVE-2022-2590: Linux kernel privilege escalation vulnerability
Link: https://securityonline.info/cve-2022-2590-linux-kernel-privilege-escalation-vulnerability/

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Targeted Individual in Singapore

August 12^th 2022 at 01:57

Full Disclosure
Backdoor.Win32.Guptachar.20 / Insecure Credential Storage
August 9^th 2022 at 03:42

Backdoor.Win32.Guptachar.20 / Insecure Credential Storage

Posted by malvuln on Aug 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/857999d2306f257b80d1b8f6a51ae8b0.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Guptachar.20
Vulnerability: Insecure Credential Storage
Description: The malware runs a web server on TCP port 2015 (default) and
uses BASIC authentication. The credentials "hacker01:imchampgr8" get stored
in a...

August 9^th 2022 at 03:42

Full Disclosure
Backdoor.Win32.Jokerdoor / Remote Stack Buffer Overflow
August 5^th 2022 at 04:15

Backdoor.Win32.Jokerdoor / Remote Stack Buffer Overflow

Posted by malvuln on Aug 04

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/783a191e7944e1af84ec0fa96d933f30.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Jokerdoor
Vulnerability: Remote Stack Buffer Overflow
Description: The malware listens on TCP port 27374. Attackers who can reach
an infected system can send a large payload and trigger a classic stack
buffer overflow...

August 5^th 2022 at 04:15

Full Disclosure
Backdoor.Win32.Bushtrommel.122 / Authentication Bypass
August 5^th 2022 at 04:15

Backdoor.Win32.Bushtrommel.122 / Authentication Bypass

Posted by malvuln on Aug 04

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/76c09bc82984c7f7ef55eb13018e0d87.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Bushtrommel.122
Vulnerability: Authentication Bypass
Description: The malware listens on TCP port 31745 runs an ftp server on
port 1030. Attackers who can reach infected systems can logon using any
username/password...

August 5^th 2022 at 04:15

Full Disclosure
Backdoor.Win32.Bushtrommel.122 / Unauthenticated Remote Command Execution
August 5^th 2022 at 04:15

Backdoor.Win32.Bushtrommel.122 / Unauthenticated Remote Command Execution

Posted by malvuln on Aug 04

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/76c09bc82984c7f7ef55eb13018e0d87_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Bushtrommel.122
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 31745 and 1030. Adversaries
who can reach infected hosts can run commands made available by the...

August 5^th 2022 at 04:15

Full Disclosure
Backdoor.Win32.Destrukor.20 / Authentication Bypass
August 2^nd 2022 at 03:58

Backdoor.Win32.Destrukor.20 / Authentication Bypass

Posted by malvuln on Aug 01

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/c790749f851d48e66e7d59cc2e451956.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Destrukor.20
Vulnerability: Authentication Bypass
Description: The malware listens on TCP port 6969. However, after sending a
specific cmd "rozmiar" the backdoor returns "moznasciagac" in Polish...

August 2^nd 2022 at 03:58

Full Disclosure
Backdoor.Win32.Destrukor.20 / Unauthenticated Remote Command Execution
August 2^nd 2022 at 03:58

Backdoor.Win32.Destrukor.20 / Unauthenticated Remote Command Execution

Posted by malvuln on Aug 01

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/c790749f851d48e66e7d59cc2e451956_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Destrukor.20
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 6969. Third-party adversaries
who can reach infected hosts can run commands made available by the...

August 2^nd 2022 at 03:58

Full Disclosure
[CVE-2022-2462] Transposh <= 1.0.8.1 “tp_history” Unauthenticated Information Disclosure
July 29^th 2022 at 03:55

[CVE-2022-2462] Transposh <= 1.0.8.1 “tp_history” Unauthenticated Information Disclosure