Read Time:2 Second
South Staffordshire Water admits it was compromised
Monthly Archives: August 2022
Win32.Ransom.BlueSky / Arbitrary Code Execution
Read Time:20 Second
Posted by malvuln on Aug 15
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/961fa85207cdc4ef86a076bbff07a409.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
Threat: Win32.Ransom.BlueSky
Vulnerability: Arbitrary Code Execution
Description: The BlueSky ransomware looks for and executes arbitrary DLLs
in its current working directory. Therefore, we can hijack a vuln DLL,
execute our own code, control…
Zyxel IPC 3605N & 4605N / Remote shell access
Read Time:24 Second
Posted by Eric Urban on Aug 15
Hello everyone,
I have identified that the Zyxel IPC 3605N and 4605N IP based security
cameras have multiple flaws. Combining these together leads to the ability
for an attacker to remotely install root shell access on the device.
A web server installed for UPnP purposes allows the plaintext passwords to
be retrieved by anyone. This grants access to the web administration
interface. From there, a tarball can be downloaded, modified with a…
Re: typeorm CVE-2022-33171
Read Time:28 Second
Posted by Andrii Kostenko via Fulldisclosure on Aug 15
I found what I think is a vulnerability in the latest typeorm 0.3.7.
TypeORM v0.3 has a new findOneBy method instead of findOneById() and it is
the only way to get a record by id
Sending undefined as a value in this method removes this parameter from the
query. This leads to the data exposure.
For example:
Users.findOneBy({id: req.query.id}) with /?id=12345 produces SELECT * FROM
Users WHERE id=12345 LIMIT 1 while removing id from the query…
DSA-5208 epiphany-browser – security update
Read Time:3 Second
Michael Catanzaro discovered a buffer overflow in the Epiphany web browser.
DSA-5209 net-snmp – security update
Read Time:10 Second
Yu Zhang and Nanyu Zhong discovered several vulnerabilities in net-snmp,
a suite of Simple Network Management Protocol applications, which could
result in denial of service or the execution of arbitrary code.
DSA-5210 webkit2gtk – security update
Read Time:3 Second
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
DSA-5211 wpewebkit – security update
Read Time:4 Second
The following vulnerabilities have been discovered in the WPE WebKit
web engine:
CVE-2020-23622
Read Time:12 Second
** UNSUPPORTED WHEN ASSIGNED ** An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header.
CVE-2020-21642
Read Time:7 Second
Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus before 4350 allows remote attackers to run arbitrary code.