Aggregator

A vulnerability classified as problematic was found in EDK2. Affected by this vulnerability is the function GetEfiGlobalVariable2. The manipulation leads to unchecked return value. This vulnerability is known as CVE-2019-14560. The attack needs to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

Several high-severity vulnerabilities have been identified in Android and Google Pixel devices, exposing millions of users to potential security risks. These flaws, categorized under various CVEs (Common Vulnerabilities and Exposures), range from privilege escalation to data theft and unauthorized access to sensitive features. While some of these vulnerabilities have been patched, others remain a concern, […]

The post Multiple Flaws With Android & Google Pixel Devices Let Attackers Elevate Privileges appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

As the holiday season approaches, with Thanksgiving and Christmas just around the corner, travelers

Thai authorities arrested fraud gangs in Bangkok for SMS blaster attacks, they used fake cell towers to send thousands of malicious SMS messages to nearby phones. Thai authorities arrested members of two Chinese cybercrime organizations, one of these groups carried out SMS blaster attacks. The crooks were driving through Bangkok’s streets while sending hundreds of […]

Неизвестный пользователь опубликовал конфиденциальные материалы шоу.

A vulnerability was found in OpenSSL 3.0.0. It has been rated as problematic. Affected by this issue is the function X509_verify_cert of the component libssl. The manipulation leads to denial of service. This vulnerability is handled as CVE-2021-4044. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenSSL 3.0.0/3.0.1/3.0.2 and classified as problematic. Affected by this issue is the function OPENSSL_LH_flush of the component Hash Table Handler. The manipulation leads to resource consumption. This vulnerability is handled as CVE-2022-1473. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenSSL 3.0.0/3.0.1/3.0.2. It has been classified as critical. This affects the function OCSP_basic_verify of the component OCSP Response Handler. The manipulation leads to improper certificate validation. This vulnerability is uniquely identified as CVE-2022-1343. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenSSL 3.0.0/3.0.1/3.0.2. It has been declared as critical. This vulnerability affects unknown code of the component RC4-MD5. The manipulation leads to insufficient verification of data authenticity. This vulnerability was named CVE-2022-1434. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Oracle JD Edwards World Security A9.4. It has been rated as very critical. This issue affects some unknown processing of the component World Software Security. The manipulation leads to out-of-bounds write. The identification of this vulnerability is CVE-2022-2274. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as very critical has been found in OpenSSL 3.0.4 on 64-bit. Affected is the function ossl_rsaz_mod_exp_avx512_x2 of the file rsaz_exp_x2.c of the component RSA Private Key Handler. The manipulation leads to memory corruption. This vulnerability is traded as CVE-2022-2274. It is possible to launch the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as very critical has been found in Oracle Essbase 21.4. This affects an unknown part of the component Essbase Web Platform. The manipulation leads to out-of-bounds write. This vulnerability is uniquely identified as CVE-2022-2274. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Oracle HTTP Server 12.2.1.4.0. It has been declared as very critical. Affected by this vulnerability is an unknown functionality of the component SSL Module. The manipulation leads to out-of-bounds write. This vulnerability is known as CVE-2022-2274. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in Oracle Siebel CRM up to 22.10. It has been rated as very critical. Affected by this issue is some unknown functionality of the component Siebel Core - Server Infrastructure. The manipulation leads to out-of-bounds write. This vulnerability is handled as CVE-2022-2274. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Oracle JD Edwards EnterpriseOne Tools. It has been declared as very critical. This vulnerability affects unknown code of the component Enterprise Infrastructure SEC. The manipulation leads to out-of-bounds write. This vulnerability was named CVE-2022-2274. The attack can be initiated remotely. There is no exploit available.

A vulnerability has been found in OpenSSL up to 3.0.5 and classified as problematic. This vulnerability affects the function EVP_CIPHER_meth_new of the component Custom Cipher Handler. The manipulation leads to missing encryption of sensitive data. This vulnerability was named CVE-2022-3358. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenSSL up to 3.0.7 and classified as problematic. This issue affects the function X509_VERIFY_PARAM_add0_policy of the component X.509 Certificate Handler. The manipulation leads to improper locking. The identification of this vulnerability is CVE-2022-3996. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

Gundaz Aghayev 写道： 中国推广的网络实名制政策给海外华人制造了更多障碍，导致了国内流行的应用在国外下载量大幅下降。在中国月度下载量最高的 62 款应用程序中，百度贴吧、钉钉、抖音、微信阅读和喜马拉雅FM 等应用在国外面临的使用障碍最多。而微信、小红书、HUAWEI FamCare 和 JusTalk 几乎没有障碍。这些访问障碍包括地区互动隔离、应用商店下架、限制手机号码前缀和跨账户验证。在受访者中因为这些障碍不再使用的仅有五分之一。2017 年《网络安全法》实施，中国互联网公司加强了实名制要求，这之后的两到三年内，中国社交应用在海外的下载量大幅下降，特别在华人较多国家。2017年，受障碍影响的中国应用的下载量达到 3200 万次，但到了 2023 年，全球范围内的下载量仅剩 570 万次。在不久的将来，个人和社群可能需要适应在分隔开的、甚至可能是完全孤立的数字通信和网络环境之中生活。

A vulnerability, which was classified as problematic, has been found in Combodo iTop 1.1.181/1.2.0. Affected by this issue is some unknown functionality of the file UI.php. The manipulation of the argument suggest_pwd leads to cross site scripting. This vulnerability is handled as CVE-2011-4275. The attack may be launched remotely. Furthermore, there is an exploit available.