#git

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients and enables an attacker with knowledge of this vulnerability to craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable.

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.8.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.

Cybersecurity researchers have discovered a new version of malware called Rilide that targets Chromium-based web browsers to steal sensitive data and steal cryptocurrency. "It exhibits a higher level of sophistication through modular design, code obfuscation, adoption to the Chrome Extension Manifest V3, and additional features such as the ability to exfiltrate stolen data to a Telegram channel

WebCalendar version 1.3 suffers from a cross site request forgery vulnerability.

Categories: News Categories: Personal Tags: Children Tags: identity Tags: theft Tags: protection Tags: SSN Tags: COPPA Identity theft is a serious problem, especially when it affects children. (Read more...) The post How to protect your child's identity appeared first on Malwarebytes Labs.

1. EXECUTIVE SUMMARY ​CVSS v3 5.9 ​ATTENTION: Exploitable remotely ​Vendor: Mitsubishi Electric ​Equipment: GOT2000 Series and GOT SIMPLE Series ​Vulnerability: Predictable Exact Value from Previous Values 2. RISK EVALUATION ​Successful exploitation of this vulnerability could allow an attacker to hijack data connections or prevent legitimate users from establishing data connections. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS ​Mitsubishi Electric reports this vulnerability affects the following HMIs when using the “FTP server” function: ​GOT2000 Series, GT21 model: versions 01.49.000 and prior ​GOT SIMPLE, GS21 model: versions 01.49.000 and prior 3.2 VULNERABILITY OVERVIEW 3.2.1 ​PREDICTABLE EXACT VALUE FROM PREVIOUS VALUES CWE-342 ​A denial-of-service and spoofing (session hijacking of data connections) vulnerability exists in the FTP server function on GOT2000 series and GOT SIMPLE series because the port number of a data connection can be easily guessed due to predictable exact valu...

Researchers say mobile malware purveyors have been abusing a bug in the Google Android platform that lets them sneak malicious code into benign mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research.

By Waqas The group of Russian hackers involved in this attack is Midnight Blizzard (aka NOBELIUM). This is a post from HackRead.com Read the original post: Russian Midnight Blizzard Hackers Hit MS Teams in Precision Attack

A vulnerability was found in Beijing Baichuo Smart S85F Management Platform up to 20230722 and classified as critical. This issue affects some unknown processing of the file importhtml.php. The manipulation of the argument sql leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235967. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.