Category Archives: Advisories

clamav-1.0.7-1.el8

Read Time:26 Second

FEDORA-EPEL-2024-cef1a533b1

Packages in this update:

clamav-1.0.7-1.el8

Update description:

Update to 1.0.7

CVE-2024-20506: Changed the logging module to disable following symlinks on Linux and Unix systems so as to prevent an attacker with existing access to the ‘clamd’ or ‘freshclam’ services from using a symlink to corrupt system files.
CVE-2024-20505: Fixed a possible out-of-bounds read bug in the PDF file parser that could cause a denial-of-service (DoS) condition.

Read More

[SYSS-2024-030]: C-MOR Video Surveillance – OS Command Injection (CWE-78)

Read Time:19 Second

Posted by Matthias Deeg via Fulldisclosure on Sep 05

Advisory ID: SYSS-2024-030
Product: C-MOR Video Surveillance
Manufacturer: za-internet GmbH
Affected Version(s): 5.2401, 6.00PL01
Tested Version(s): 5.2401, 6.00PL01
Vulnerability Type: OS Command Injection (CWE-78)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2024-04-05
Solution Date: –
Public Disclosure: 2024-09-04…

Read More

[SYSS-2024-029]: C-MOR Video Surveillance – Dependency on Vulnerable Third-Party Component (CWE-1395)

Read Time:17 Second

Posted by Matthias Deeg via Fulldisclosure on Sep 05

Advisory ID: SYSS-2024-029
Product: C-MOR Video Surveillance
Manufacturer: za-internet GmbH
Affected Version(s): 5.2401
Tested Version(s): 5.2401
Vulnerability Type: Dependency on Vulnerable Third-Party
Component (CWE-1395)
Use of Unmaintained Third Party Components
(CWE-1104)
Risk Level: High
Solution Status: Fixed…

Read More

[SYSS-2024-028]: C-MOR Video Surveillance – Cleartext Storage of Sensitive Information (CWE-312)

Read Time:18 Second

Posted by Matthias Deeg via Fulldisclosure on Sep 05

Advisory ID: SYSS-2024-028
Product: C-MOR Video Surveillance
Manufacturer: za-internet GmbH
Affected Version(s): 5.2401, 6.00PL01
Tested Version(s): 5.2401, 6.00PL01
Vulnerability Type: Cleartext Storage of Sensitive Information
(CWE-312)
Risk Level: Medium
Solution Status: Open
Manufacturer Notification: 2024-04-05
Solution Date: –
Public…

Read More

[SYSS-2024-027]: C-MOR Video Surveillance – Improper Privilege Management (CWE-269)

Read Time:18 Second

Posted by Matthias Deeg via Fulldisclosure on Sep 05

Advisory ID: SYSS-2024-027
Product: C-MOR Video Surveillance
Manufacturer: za-internet GmbH
Affected Version(s): 5.2401, 6.00PL01
Tested Version(s): 5.2401, 6.00PL01
Vulnerability Type: Improper Privilege Management (CWE-269)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2024-04-05
Solution Date: –
Public Disclosure:…

Read More

[SYSS-2024-026]: C-MOR Video Surveillance – Unrestricted Upload of File with Dangerous Type (CWE-434)

Read Time:19 Second

Posted by Matthias Deeg via Fulldisclosure on Sep 05

Advisory ID: SYSS-2024-026
Product: C-MOR Video Surveillance
Manufacturer: za-internet GmbH
Affected Version(s): 5.2401
Tested Version(s): 5.2401
Vulnerability Type: Unrestricted Upload of File with Dangerous
Type (CWE-434)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2024-04-05
Solution Date: 2024-07-31
Public Disclosure:…

Read More

[SYSS-2024-025]: C-MOR Video Surveillance – Relative Path Traversal (CWE-23)

Read Time:19 Second

Posted by Matthias Deeg via Fulldisclosure on Sep 05

Advisory ID: SYSS-2024-025
Product: C-MOR Video Surveillance
Manufacturer: za-internet GmbH
Affected Version(s): 5.2401
Tested Version(s): 5.2401
Vulnerability Type: Relative Path Traversal (CWE-23)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2024-04-05
Solution Date: 2024-07-31
Public Disclosure: 2024-09-04
CVE…

Read More

Backdoor.Win32.Symmi.qua / Remote Stack Buffer Overflow (SEH)

Read Time:20 Second

Posted by malvuln on Sep 05

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source:
https://malvuln.com/advisory/6e81618678ddfee69342486f6b5ee780.txt
Contact: malvuln13 () gmail com
Media: x.com/malvuln

Threat: Backdoor.Win32.Symmi.qua
Vulnerability: Remote Stack Buffer Overflow (SEH)
Description: The malware listens on two random high TCP ports, when
connecting (ncat) one port will return a single character like “♣”
ord(a)…

Read More

HackTool.Win32.Freezer.br (WinSpy) / Insecure Credential Storage

Read Time:20 Second

Posted by malvuln on Sep 05

Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024
Original source:
https://malvuln.com/advisory/2992129c565e025ebcb0bb6f80c77812.txt
Contact: malvuln13 () gmail com
Media: x.com/malvuln

Threat: HackTool.Win32.Freezer.br (WinSpy)
Vulnerability: Insecure Credential Storage
Description: The malware listens on TCP ports 443, 80 and provides a
web interface for remote access to victim information like screenshots
etc.The username…

Read More