Wordpress plugin - WPvivid Backup - CVE-2022-2863.

October 3^rd 2022 at 15:12

Posted by Rodolfo Tavares via Fulldisclosure on Oct 03

=====[ Tempest Security Intelligence - ADV-15/2022
]==========================

Wordpress plugin - WPvivid Backup - Version < 0.9.76

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]==================================================
* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Vulnerability...

Full Disclosure

Backdoor.Win32.NTRC / Weak Hardcoded Credentials

October 3^rd 2022 at 15:12

Posted by malvuln on Oct 03

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/273fd3f33279cc9c0378a49cf63d7a06.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.NTRC
Vulnerability: Weak Hardcoded Credentials
Family: NTRC
Type: PE32
MD5: 273fd3f33279cc9c0378a49cf63d7a06
Vuln ID: MVID-2022-0646
Disclosure: 10/02/2022
Description: The malware listens on TCP port 6767....

Full Disclosure

Backdoor.Win32.Delf.eg / Unauthenticated Remote Command Execution

October 3^rd 2022 at 15:12

Posted by malvuln on Oct 03

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/de6220a8e8fcbbee9763fb10e0ca23d7.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Delf.eg
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 7401. Third-party adversarys
who can reach infected systems can issue commands made available by the...

Full Disclosure

ZKBiosecurity - Authenticated SQL Injection resulting in RCE (CVE-2022-36635)

October 1^st 2022 at 06:27

Posted by Caio B on Sep 30

#######################ADVISORY INFORMATION#######################

Product: ZKSecurity BIO

Vendor: ZKTeco (
https://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurity_V5000_4.1.2)

Version Affected: 4.1.2

CVE: CVE-2022-36635

Vulnerability: SQL Injection (with a plus: RCE)

#######################CREDIT#######################

This vulnerability was discovered and researched by Caio Burgardt and
Silton Santos....

Full Disclosure

ZKBioSecurity 3.0.5- Privilege Escalation to Admin (CVE-2022-36634)

October 1^st 2022 at 06:27

Posted by Caio B on Sep 30

#######################ADVISORY INFORMATION#######################

Product: ZKSecurity BIO

Vendor: ZKTeco

Version Affected: 3.0.5.0_R

CVE: CVE-2022-36634

Vulnerability: User privilege escalation

#######################CREDIT#######################

This vulnerability was discovered and researched by Caio Burgardt and
Silton Santos.

#######################INTRODUCTION#######################

Based on the hybrid biometric technology and...

Full Disclosure

SEC Consult SA-20220923-0 :: Multiple Memory Corruption Vulnerabilities in COVESA (Connected Vehicle Systems Alliance) DLT daemon

September 27^th 2022 at 11:18

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 27

SEC Consult Vulnerability Lab Security Advisory < 20220923-0 >
=======================================================================
title: Multiple Memory Corruption Vulnerabilities
product: COVESA DLT daemon (Diagnostic Log and Trace)
Connected Vehicle Systems Alliance (COVESA), formerly GENIVI
vulnerable version: <= 2.18.8
fixed version: current master branch commit...

Full Disclosure

Backdoor.Win32.Bingle.b / Weak Hardcoded Credentials

September 27^th 2022 at 11:18

Posted by malvuln on Sep 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/eacaa12336f50f1c395663fba92a4d32.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Bingle.b
Vulnerability: Weak Hardcoded Credentials
Description: The malware is packed using ASPack 2.11, listens on TCP port
22 and requires authentication. However, the password "let me in" is weak
and...

Full Disclosure

Backdoor.Win32.Psychward.b / Weak Hardcoded Credentials

September 27^th 2022 at 11:18

Posted by malvuln on Sep 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/0b8cf90ab9820cb3fcb7f1d1b45e4e57.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Psychward.b
Vulnerability: Weak Hardcoded Credentials
Description: The malware listens on TCP port 8888 and requires
authentication. However, the password "4174" is weak and hardcoded in
cleartext within the PE...

Full Disclosure

Backdoor.Win32.Augudor.b / Remote File Write Code Execution

September 27^th 2022 at 11:18

Posted by malvuln on Sep 27

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/94ccd337cbdd4efbbcc0a6c888abb87d.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Augudor.b
Vulnerability: Remote File Write Code Execution
Description: The malware drops an empty file named "zy.exe" and listens on
TCP port 810. Third-party adversaries who can reach the infected host can...

Full Disclosure

Backdoor.Win32.Hellza.120 / Unauthorized Remote Command Execution

September 20^th 2022 at 00:30

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hellza.120
Vulnerability: Unauthorized Remote Command Execution
Description: The malware listens on TCP ports 12122, 21. Third-party
adversarys who can reach infected systems can issue commands made available
by the...

Full Disclosure

Trojan-Dropper.Win32.Corty.10 / Insecure Credential Storage

September 20^th 2022 at 00:30

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/f72138e574743640bdcdb9f102dff0a5.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Corty.10
Vulnerability: Insecure Credential Storage
Description: The malware stores its credentials in cleartext within the
Windows registry.
Family: Corty
Type: PE32
MD5: f72138e574743640bdcdb9f102dff0a5
Vuln ID:...

Full Disclosure

Trojan.Ransom.Ryuk.A / Arbitrary Code Execution

September 20^th 2022 at 00:30

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/5ac0f050f93f86e69026faea1fbb4450.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Ransom.Ryuk.A
Vulnerability: Arbitrary Code Execution
Description: The ransomware looks for and executes DLLs in its current
directory. Therefore, we can potentially hijack a vuln DLL execute our own
code, control and terminate...

Full Disclosure

Backdoor.Win32.Hellza.120 / Authentication Bypass

September 20^th 2022 at 00:30

Posted by malvuln on Sep 19

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/2cbd0fcf4d5fd5fb6c8014390efb0b21_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hellza.120
Vulnerability: Authentication Bypass
Description: The malware listens on TCP ports 12122, 21. Third-party
adversarys who can reach infected systems can logon using any
username/password combination....

Full Disclosure

Re: over 2000 packages depend on abort()ing libgmp

September 20^th 2022 at 00:28

Posted by Matthew Fernandez on Sep 19

What is the security boundary being violated here? As a maintainer of
some of the packages implicated here, I’m unsure what my actionable
tasks are. The threat model(s) for my packages does not consider crashes
to be a security violation. On the other side, things like crypto code
frequently use their own non-GMP implementation of bignum arith for this
(and other) reason.

Not trying to brush this off. But I’m just trying to gain an...

Full Disclosure

SEC Consult SA-20220914-0 :: Improper Access Control in SAP® SAProuter

September 16^th 2022 at 03:30

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15

SEC Consult Vulnerability Lab Security Advisory < 20220914-0 >
=======================================================================
title: Improper Access Control
product: SAP® SAProuter
vulnerable version: see section "Vulnerable / tested versions"
fixed version: see SAP security note 3158375
CVE number: CVE-2022-27668
impact: high
homepage:...

Full Disclosure

SEC Consult SA-20220915-0 :: Local Privilege Escalation im SAP® SAPControl Web Service Interface (sapuxuserchk)

September 16^th 2022 at 03:30

Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Sep 15

SEC Consult Vulnerability Lab Security Advisory < 20220915-0 >
=======================================================================
title: Local privilege escalation
product: SAP® SAPControl Web Service Interface (sapuxuserchk)
vulnerable version: see section "Vulnerable / tested versions"
fixed version: see SAP security note 3158619
CVE number: CVE-2022-29614...

Full Disclosure

over 2000 packages depend on abort()ing libgmp

September 16^th 2022 at 03:29

Posted by Georgi Guninski on Sep 15

ping world

libgmp is library about big numbers.

it is not a library for very big numbers, because
if libgmp meets a very big number, it calls abort()
and coredumps.

2442 packages depend on libgmp on ubuntu20.

guest3@ubuntu20:~/prim$ apt-cache rdepends libgmp10 | wc -l
2442

gawk crash:

guest3@ubuntu20:~/prim$ gawk --bignum 'BEGIN { a = 2 ^ 2 ^41; print "a =", a }'
gmp: overflow in mpz type
Aborted (core dumped)...

Full Disclosure

APPLE-SA-2022-09-12-4 macOS Monterey 12.6

September 12^th 2022 at 19:07

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-4 macOS Monterey 12.6

macOS Monterey 12.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213444.

ATS
Available for: macOS Monterey
Impact: An app may be able to bypass Privacy preferences
Description: A logic issue was addressed with improved state
management.
CVE-2022-32902: Mickey Jin (@patch1t)

iMovie
Available for: macOS Monterey
Impact: A user may...

Full Disclosure

APPLE-SA-2022-09-12-1 iOS 16

September 12^th 2022 at 19:07

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-1 iOS 16

iOS 16 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213446.

Additional CVE entries to be added soon.

Contacts
Available for: iPhone 8 and later
Impact: An app may be able to bypass Privacy preferences
Description: This issue was addressed with improved checks.
CVE-2022-32854: Holger Fuhrmannek of Deutsche Telekom Security

Kernel
Available...

Full Disclosure

APPLE-SA-2022-09-12-2 iOS 15.7 and iPadOS 15.7

September 12^th 2022 at 19:07

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-2 iOS 15.7 and iPadOS 15.7

iOS 15.7 and iPadOS 15.7 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213445.

Contacts
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2
and later, iPad 5th generation and later, iPad mini 4 and later, and
iPod touch (7th generation)
Impact: An app may be able to bypass Privacy preferences
Description:...

Full Disclosure

APPLE-SA-2022-09-12-5 Safari 16

September 12^th 2022 at 19:07

Posted by Apple Product Security via Fulldisclosure on Sep 12

APPLE-SA-2022-09-12-5 Safari 16

Safari 16 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213442.

Safari Extensions
Available for: macOS Big Sur and macOS Monterey
Impact: A website may be able to track users through Safari web
extensions
Description: A logic issue was addressed with improved state
management.
WebKit Bugzilla: 242278
CVE-2022-32868: Michael

WebKit...

Full Disclosure

Multiple vulnerabilities discovered in Qualys Cloud Agent

September 12^th 2022 at 19:06

Posted by Daniel Wood via Fulldisclosure on Sep 12

The Unqork Security team discovered multiple security vulnerabilities in
the Qualys Cloud Agent, to include arbitrary code execution.

CVE-2022-29549 (Arbitrary Code Execution)
https://nvd.nist.gov/vuln/detail/CVE-2022-29549

CVE-2022-29550 (Sensitive Information Disclosure)
https://nvd.nist.gov/vuln/detail/CVE-2022-29550

Read more:
https://www.unqork.com/resources/unqork-and-qualys-partner-to-resolve-zero-day-vulnerabilities...

Full Disclosure

[SYSS-2022-041] Remote Code Execution due to unsafe JMX default configuration in JasperReports Server

September 12^th 2022 at 19:06

Posted by Moritz Bechler on Sep 12

Advisory ID: SYSS-2022-041
Product: JasperReports Server
Manufacturer: TIBCO Software Inc.
Tested Version(s): 8.0.2 Community Edition
Vulnerability Type: CWE-502: Deserialization of Untrusted Data
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2022-06-10
Solution Date: 2022-08-10
Public Disclosure: 2022-09-09
CVE Reference:...

Full Disclosure

Trojan.Win32.Autoit.fhj / Named Pipe Null DACL

September 9^th 2022 at 03:25

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/d871836f77076eeed87eb0078c1911c7_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Autoit.fhj
Vulnerability: Named Pipe Null DACL
Family: Autoit
Type: PE32
MD5: d871836f77076eeed87eb0078c1911c7
Vuln ID: MVID-2022-0638
Disclosure: 09/06/2022
Description: The malware creates two processes...

Full Disclosure

Trojan.Win32.Autoit.fhj / Insecure Permissions

September 9^th 2022 at 03:25

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/d871836f77076eeed87eb0078c1911c7.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Autoit.fhj
Vulnerability: Insecure Permissions
Description: The malware writes two hidden DLL files "vp8decoder.dll" and
"vp8encoder.dll" to its installation directory granting full (F)
permissions to...

Full Disclosure

Backdoor.Win32.Winshell.5_0 / Weak Hardcoded Credentials

September 9^th 2022 at 03:25

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/5bc5f72d19019a2fa3b75896e82ae1e5.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Winshell.5_0
Vulnerability: Weak Hardcoded Credentials
Description: The malware is UPX packed, listens on TCP port 5277 and
requires authentication for remote access. However, the password
"123456789" is weak...

Full Disclosure

Backdoor.Win32.Hupigon.aspg / Insecure Service Path

September 9^th 2022 at 03:25

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/121bf601275e2aed0c3a6fe7910f9826.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hupigon.aspg
Vulnerability: Insecure Service Path
Description: The malware creates a service with an unquoted path. Attackers
who can place an arbitrary executable named "Program.exe" under c:\ drive
can...

Full Disclosure

Trojan-Spy.Win32.Pophot.bsl / Insecure Permissions

September 9^th 2022 at 03:25

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/8c0e6ec6b8ac9eb1169e63df71f24456.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Spy.Win32.Pophot.bsl
Vulnerability: Insecure Permissions
Description: The malware writes a BATCH file ".bat" to c drive granting
change (C) permissions to the authenticated user group. Standard users can
rename the...

Full Disclosure

Trojan-Ransom.Win32.Hive.bv / Arbitrary Code Execution

September 9^th 2022 at 03:25

Posted by malvuln on Sep 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/44aba241dd3f0d156c6ed82a0ab3a9e1.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Ransom.Win32.Hive.bv
Vulnerability: Arbitrary Code Execution
Description: Hive Ransomware will load and execute arbitrary .EXE PE files
if a third-party adversary or defender uses the vulnerable naming
convention of...

Full Disclosure

sagemath denial of service with abort() in gmp: overflow in mpz type

September 9^th 2022 at 03:24

Posted by Georgi Guninski on Sep 08

sagemath 9.0 and reportedly later on ubuntu 20.

sagemath gives access to the python interpreter,
so code execution is trivial.

We give DoS attacks, which terminates the sagemath process
with abort(), when raising symbolic expression to large integer power.

We get abort() with stack:

gmp: overflow in mpz type

#6 0x00007f55c83ee72e in __GI_abort () at
/build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79
#7 0x00007f55c56e0d20 in __gmpz_realloc ()...

Full Disclosure

AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal

September 9^th 2022 at 03:24

Posted by Jens Regel | CRISEC on Sep 08

Title:
======
AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal

Author:
=======
Jens Regel, CRISEC IT-Security

CVE:
====
CVE-2022-23854

Advisory:
=========
https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal/

Timeline:
=========
25.06.2021 Vulnerability discovered
25.06.2021 Send details to custfirstsupport () aveva com
21.09.2021 Vendor response, fix is available until Q1/2022
25.09.2021 Vendor...

Full Disclosure

123ADV-001: Stack Buffer Overflow in Lotus 1-2-3 R3 for UNIX/Linux

September 6^th 2022 at 02:59

Posted by Tavis Ormandy on Sep 05

# About

The 123 command is a spreadsheet application for UNIX-based systems that
can be used in interactive mode to create and modify financial and
scientific models.

For more information, see https://123r3.net

# Advisory

A stack buffer overflow was reported in the cell format processing
routines. If a victim opens an untrusted malicious worksheet, code
execution could occur.

There have been no reports of this vulnerability being exploited...

Full Disclosure

Open-Xchange Security Advisory 2022-09-01

September 2^nd 2022 at 03:40

Posted by Martin Heiland via Fulldisclosure on Sep 01

Dear subscribers,

we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those
vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne.

Yours sincerely,
Martin Heiland, Open-Xchange GmbH

Product: OX App Suite
Vendor: OX Software GmbH

Internal reference: MWB-1540
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable...

Full Disclosure

APPLE-SA-2022-08-31-1 iOS 12.5.6

September 1^st 2022 at 01:40

Posted by Apple Product Security via Fulldisclosure on Aug 31

APPLE-SA-2022-08-31-1 iOS 12.5.6

iOS 12.5.6 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213428.

iOS 12 is not impacted by CVE-2022-32894.

WebKit
Available for: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad
mini 2, iPad mini 3, and iPod touch (6th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of...

Full Disclosure

Re: typeorm CVE-2022-33171

August 19^th 2022 at 17:02

Posted by Tobias Schneider on Aug 19

Someone should tell Snyk about the risks of "Supply Chain vulnerabilities"
...

(and yes this is a vulnerability, nice find!)

LoL'ing at Maintainer.

Cheers, @haxel0rd.

Full Disclosure

APPLE-SA-2022-08-17-1 iOS 15.6.1 and iPadOS 15.6.1

August 19^th 2022 at 17:01

Posted by Apple Product Security via Fulldisclosure on Aug 19

APPLE-SA-2022-08-17-1 iOS 15.6.1 and iPadOS 15.6.1

iOS 15.6.1 and iPadOS 15.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213412.

Kernel
Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2
and later, iPad 5th generation and later, iPad mini 4 and later, and
iPod touch (7th generation)
Impact: An application may be able to execute arbitrary code with...

Full Disclosure

APPLE-SA-2022-08-17-2 macOS Monterey 12.5.1

August 19^th 2022 at 17:01

Posted by Apple Product Security via Fulldisclosure on Aug 19

APPLE-SA-2022-08-17-2 macOS Monterey 12.5.1

macOS Monterey 12.5.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213413.

Kernel
Available for: macOS Monterey
Impact: An application may be able to execute arbitrary code with
kernel privileges. Apple is aware of a report that this issue may
have been actively exploited.
Description: An out-of-bounds write issue was addressed...

Full Disclosure

[CVE-2022-2536] Transposh <= 1.0.8.1 “tp_translation” Authorization Bypass

August 19^th 2022 at 17:01

Posted by Julien Ahrens (RCE Security) on Aug 19

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Transposh WordPress Translation
Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type: Incorrect Authorization [CWE-863]
Date found: 2022-07-23
Date published: 2022-08-16
CVSSv3 Score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVE: CVE-2022-2536

2. CREDITS...

Full Disclosure

APPLE-SA-2022-08-18-1 Safari 15.6.1

August 19^th 2022 at 17:01

Posted by Apple Product Security via Fulldisclosure on Aug 19

APPLE-SA-2022-08-18-1 Safari 15.6.1

Safari 15.6.1 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT213414.

WebKit
Available for: macOS Big Sur and macOS Catalina
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution. Apple is aware of a report that this issue
may have been actively exploited.
Description: An out-of-bounds write issue was...

Full Disclosure

Trovent Security Advisory 2110-01 / Insecure data storage in Polar Flow Android application

August 19^th 2022 at 17:01

Posted by Stefan Pietsch on Aug 19

# Trovent Security Advisory 2110-01 #
#####################################

Insecure data storage in Polar Flow Android application
#######################################################

Overview
########

Advisory ID: TRSA-2110-01
Advisory version: 1.0
Advisory status: Public
Advisory URL: https://trovent.io/security-advisory-2110-01
Affected product: Polar Flow Android mobile application (fi.polar.polarflow)
Affected version: 5.7.1
Vendor:...

Full Disclosure

Zyxel IPC 3605N & 4605N / Remote shell access

August 16^th 2022 at 03:32

Posted by Eric Urban on Aug 15

Hello everyone,

I have identified that the Zyxel IPC 3605N and 4605N IP based security
cameras have multiple flaws. Combining these together leads to the ability
for an attacker to remotely install root shell access on the device.

A web server installed for UPnP purposes allows the plaintext passwords to
be retrieved by anyone. This grants access to the web administration
interface. From there, a tarball can be downloaded, modified with a...

Full Disclosure

Re: typeorm CVE-2022-33171

August 16^th 2022 at 03:32

Posted by Andrii Kostenko via Fulldisclosure on Aug 15

I found what I think is a vulnerability in the latest typeorm 0.3.7.
TypeORM v0.3 has a new findOneBy method instead of findOneById() and it is
the only way to get a record by id

Sending undefined as a value in this method removes this parameter from the
query. This leads to the data exposure.

For example:
Users.findOneBy({id: req.query.id}) with /?id=12345 produces SELECT * FROM
Users WHERE id=12345 LIMIT 1 while removing id from the query...

Full Disclosure

Win32.Ransom.BlueSky / Arbitrary Code Execution

August 16^th 2022 at 03:32

Posted by malvuln on Aug 15

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/961fa85207cdc4ef86a076bbff07a409.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Win32.Ransom.BlueSky
Vulnerability: Arbitrary Code Execution
Description: The BlueSky ransomware looks for and executes arbitrary DLLs
in its current working directory. Therefore, we can hijack a vuln DLL,
execute our own code, control...

Full Disclosure

CVE-2022-2590: Linux kernel privilege escalation vulnerability

August 12^th 2022 at 01:57

Posted by Turritopsis Dohrnii Teo En Ming on Aug 11

Subject: CVE-2022-2590: Linux kernel privilege escalation vulnerability

Good day from Singapore,

Just sharing this Linux kernel security vulnerability.

Article: CVE-2022-2590: Linux kernel privilege escalation vulnerability
Link: https://securityonline.info/cve-2022-2590-linux-kernel-privilege-escalation-vulnerability/

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Targeted Individual in Singapore

Full Disclosure

Backdoor.Win32.Guptachar.20 / Insecure Credential Storage

August 9^th 2022 at 03:42

Posted by malvuln on Aug 08

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/857999d2306f257b80d1b8f6a51ae8b0.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Guptachar.20
Vulnerability: Insecure Credential Storage
Description: The malware runs a web server on TCP port 2015 (default) and
uses BASIC authentication. The credentials "hacker01:imchampgr8" get stored
in a...

Full Disclosure

Backdoor.Win32.Jokerdoor / Remote Stack Buffer Overflow

August 5^th 2022 at 04:15

Posted by malvuln on Aug 04

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/783a191e7944e1af84ec0fa96d933f30.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Jokerdoor
Vulnerability: Remote Stack Buffer Overflow
Description: The malware listens on TCP port 27374. Attackers who can reach
an infected system can send a large payload and trigger a classic stack
buffer overflow...

Full Disclosure

Backdoor.Win32.Bushtrommel.122 / Authentication Bypass

August 5^th 2022 at 04:15

Posted by malvuln on Aug 04

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/76c09bc82984c7f7ef55eb13018e0d87.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Bushtrommel.122
Vulnerability: Authentication Bypass
Description: The malware listens on TCP port 31745 runs an ftp server on
port 1030. Attackers who can reach infected systems can logon using any
username/password...

Full Disclosure

Backdoor.Win32.Bushtrommel.122 / Unauthenticated Remote Command Execution

August 5^th 2022 at 04:15

Posted by malvuln on Aug 04

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/76c09bc82984c7f7ef55eb13018e0d87_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Bushtrommel.122
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 31745 and 1030. Adversaries
who can reach infected hosts can run commands made available by the...

Full Disclosure

Backdoor.Win32.Destrukor.20 / Authentication Bypass

August 2^nd 2022 at 03:58

Posted by malvuln on Aug 01

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/c790749f851d48e66e7d59cc2e451956.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Destrukor.20
Vulnerability: Authentication Bypass
Description: The malware listens on TCP port 6969. However, after sending a
specific cmd "rozmiar" the backdoor returns "moznasciagac" in Polish...

Full Disclosure

Backdoor.Win32.Destrukor.20 / Unauthenticated Remote Command Execution

August 2^nd 2022 at 03:58

Posted by malvuln on Aug 01

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/c790749f851d48e66e7d59cc2e451956_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Destrukor.20
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 6969. Third-party adversaries
who can reach infected hosts can run commands made available by the...

Full Disclosure

[CVE-2022-2462] Transposh <= 1.0.8.1 “tp_history” Unauthenticated Information Disclosure

July 29^th 2022 at 03:55