Malware

Stealer

Pony (also known as Fareit or Siplog) is a malware categorized as a loader and stealer, although it is also used as a botnet, being a tool that has been used for more than 10 years and is still in use.

Malware

Backdoor

New macOS Backdoor Written in Rust Shows Possible Link with Windows Ransomware Group

REPORT

REPORT

Actions EdgeRouter network defenders and users should implement to protect against APT28 activity

Malware

Stealer

When Stealers Converge: New Variant of Atomic Stealer in the Wild

Malware

Banking

According to ESET Research, Mispadu is an ambitious Latin American banking trojan that utilizes McDonald’s malvertising and extends its attack surface to web browsers.

Malware

Linux

Modular malware framework targeting SOHO network devices

Malware

Loader

Compromised Routers Are Still Leveraged as Malicious Infrastructure to Target Government Organizations in Europe and the Caucasus

Vulnerebility

CVE

Microsoft Outlook Elevation of Privilege Vulnerability

APT

APT

SVR cyber actors adapt tactics for initial cloud access

Vulnerebility

CVE

4 Million WordPress Sites affected by Stored Cross-Site Scripting Vulnerability in LiteSpeed Cache Plugin

Malware

RAT

Analysis of Nood RAT Used in Attacks Against Linux (Gh0st RAT’s Variant)

Vulnerebility

CVE

A GPU kernel can read sensitive data from another GPU kernel (even from another user or app) through an optimized GPU memory region called _local memory_ on various architectures.

Vulnerebility

CVE

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

Vulnerebility

CVE

The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. This is actively being exploited in the wild.

Malware

Loader

Unveiling UAC-0184: The Steganography Saga of the IDAT Loader Delivering Remcos RAT to a Ukraine Entity in Finland

Spam

SPAM

“SubdoMailing” — Thousands of Hijacked Major-Brand Subdomains Found Bombarding Users With Millions of Malicious Emails

Malware

Stealer

DarkVNC is a hidden utility based on the Virtual Network Computing (VNC) technology, initially promoted on an Exploit forum in 2016.

Malware

RAT

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Malware

RAT

We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.

Malware

Banking

Ousaban: LATAM Banking Malware Abusing Cloud Services

Malware

Banking

Tweet on recent Mekotio Banker campaign

Malware

Banking

First spotted in the wild in 2017, Astaroth is a highly prevalent, information-stealing Latin American banking trojan. It is written in Delphi and has some innovative execution and attack techniques.

25.2.24

Exploit

WebApps

PHP

25.2.24

Exploit

WebApps

PHP

25.2.24

Exploit

WebApps

Multiple

25.2.24

Exploit

WebApps

Multiple

25.2.24

Exploit

WebApps

PHP

25.2.24

Exploit

Local

Windows_x86-64

25.2.24

Exploit

Local

Windows_x86-64

25.2.24

Exploit

DoS

Windows

25.2.24

Exploit

WebApps

PHP

25.2.24

Exploit

Local

Hardware

25.2.24

Exploit

WebApps

Linux

25.2.24

Exploit

WebApps

Multiple

25.2.24

Exploit

WebApps

PHP

25.2.24

Exploit

WebApps

Windows

25.2.24

Exploit

DoS

Hardware

25.2.24

Exploit

WebApps

Multiple

Ransomware

Ransomware

This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations.

Vulnerebility

CVE

The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use sensitive data with certain actions without prompting the user.

Crypto

Crypto

iMessage with PQ3: The new state of the art in quantum-secure messaging at scale

Malware

Worm

SSH-Snake: New Self-Modifying Worm Threatens Networks

Malware

RAT

To Russia With Love: Assessing a KONNI-Backdoored Suspected Russian Consular Software Installer

Vulnerebility

CVE

The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauthorized access to a protected Wi-Fi network. An attacker can complete the EAPOL handshake by skipping Msg2/4 and instead sending Msg4/4 with an all-zero key.

Vulnerebility

CVE

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_supplicant must be configured to not verify the network's TLS certificate during Phase 1 authentication, and an eap_peap_decrypt vulnerability can then be abused to skip Phase 2 authentication.

Malware

Stealer

Mustang Panda’s PlugX new variant targetting Taiwanese government and diplomats

Campaign

Campaign

CHINESE THREAT ACTORS TARGETING EUROPE IN SMUGX CAMPAIGN

Operation

Operation

Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

Malware

Stealer

Extra credit: VietCredCare information stealer takes aim at Vietnamese businesses

Campaign

Campaign

Earth Preta Campaign Uses DOPLUGS to Target Asia

Vulnerebility

CVE

Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.

Vulnerebility

CVE

Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).

Malware

Miner

Migo - a Redis Miner with Novel System Weakening Techniques

Malware

Backdoor

Sysjoker is a backdoor malware that was first discovered in December 2021 by Intezer.

Malware

Wipper

According to Security Joes, this malware is an x64 ELF executable, lacking obfuscation or protective measures. It allows attackers to specify target folders and can potentially destroy an entire operating system if run with root permissions.

REPORT

REPORT

Israel-Hamas War in Cyber

Vulnerebility

CVE

CVE-2024-25600 (CVSS score: 9.8), enables unauthenticated attackers to achieve remote code execution. It impacts all versions of the Bricks up to and including 1.9.6.

Malware

Android

Anatsa Trojan Returns: Targeting Europe and Expanding Its Reach

Group

Group

Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign

Malware

Backdoor

Through its managed security services offerings, Volexity routinely identifies spear-phishing campaigns targeting its customers.

Malware

Stealer

Raccoon Stealer v2 – Part 1: The return of the dead

Malware

Stealer

An info stealer is malicious software (malware) that seeks to steal private data from a compromised device, including passwords, cookies, autofill information from browsers, and cryptocurrency wallet information.

Malware

Backdoor

According to CERT-UA, this malware makes use of XSLT (Extensible Stylesheet Language Transformations) and COM-hijacking. Its specificity is the presence of a server part, which is usually installed on compromised MS Exchange servers in the form of a MOF (Managed Object Format) file using the Desired State Configuration (DCS) PowerShell tool), effectively turning a legitimate server into a malware control center.

Malware

Backdoor

TinyTurla Next Generation - Turla APT spies on Polish NGOs

Vulnerebility

CVE

FLATLINED: ANALYZING PULSE SECURE FIRMWARE AND BYPASSING INTEGRITY CHECKING

Malware

iOS

Group-IB uncovers the first iOS Trojan harvesting facial recognition data used for unauthorized access to bank accounts. The GoldDigger family grows

Malware

Loader

This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads.

APT

APT

Water Hydra’s Zero-Day Attack Chain Targets Financial Traders

Vulnerebility

CVE

Internet Shortcut Files Security Feature Bypass Vulnerability

Malware

Loader

CVE-2024-21412: Water Hydra Targets Traders With Microsoft Defender SmartScreen Zero-Day

Vulnerebility

CVE

(CVSS score: 6.5) - Windows Hyper-V Denial of Service Vulnerability

Vulnerebility

CVE

(CVSS score: 7.5) - Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

Vulnerebility

CVE

(CVSS score: 8.0) - Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability

Vulnerebility

CVE

(CVSS score: 9.8) - Microsoft Exchange Server Elevation of Privilege Vulnerability

Vulnerebility

CVE

(CVSS score: 9.8) - Microsoft Outlook Remote Code Execution Vulnerability

Vulnerebility

CVE

(CVSS score: 8.1) - Internet Shortcut Files Security Feature Bypass Vulnerability

Vulnerebility

CVE

(CVSS score: 7.6) - Windows SmartScreen Security Feature Bypass Vulnerability

BOTNET

BOTNET

Diving Into Glupteba's UEFI Bootkit

Malware

Bootkit

Diving Into Glupteba's UEFI Bootkit

Malware

Loader

Pikabot is a malware loader that originally emerged in early 2023. Over the past year, ThreatLabz has been tracking the development of Pikabot and its modus operandi.

Vulnerebility

CVE

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Malware

Backdoor

Ivanti Connect Secure: Journey to the core of the DSLog backdoor

Vulnerebility

CVE

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Ransomware

Ransomware

Akira Ransomware and Exploitation of Cisco Anyconnect Vulnerability CVE-2020-3259

Vulnerebility

CVE

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve memory contents on an affected device, which could lead to the disclosure of confidential information.

Malware

macOS

New macOS Backdoor Written in Rust Shows Possible Link with Windows Ransomware Group

Campaign

Spam

SNS Sender | Active Campaigns Unleash Messaging Spam Through the Cloud

Ransomware

Anti-Ransom tool

Korea Internet & Security Agency (KISA) distribuuje nastroj pro obnovu ransomwaru Rhysida.

Malware

RAT

The U.S. Justice Department (DoJ) on Friday announced the seizure of online infrastructure that was used to sell a remote access trojan (RAT) called Warzone RAT.

Malware

Backdoor

New MacOS Backdoor Written in Rust Shows Possible Link with Windows Ransomware Group

Malware

Worm

RASPBERRY ROBIN KEEPS RIDING THE WAVE OF ENDLESS 1-DAYS

Exploit

WebApps

PHP

Exploit

WebApps

PHP

Exploit

WebApps

PHP

Exploit

WebApps

PHP

Exploit

DoS

Multiple

Exploit

Remote

Hardware

Exploit

WebApps

PHP

Exploit

Remote

Hardware

Exploit

WebApps

PHP

Exploit

WebApps

PHP

Exploit

WebApps

Multiple

Exploit

WebApps

PHP

Exploit

WebApps

PHP

Exploit

WebApps

PHP

Exploit

WebApps

PHP

Malware

Android

MoqHao evolution: New variants start automatically right after installation

Malware

Banking

Coyote: A multi-stage banking Trojan abusing the Squirrel installer

Vulnerebility

CVE

FortiOS - Out-of-bound Write in sslvpnd

Vulnerebility

CVE

CVE-2024-22024 (XXE) for Ivanti Connect Secure and Ivanti Policy Secure

Malware

Backdoor

New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization

Malware

Loader

HijackLoader Expands Techniques to Improve Defense Evasion

Malware

Stealer

Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer

Vulnerebility

CVE

Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the login banner and takeover the user account.

Vulnerebility

CVE

Aria Operations for Networks contains a local file read vulnerability. A malicious actor with admin privileges may exploit this vulnerability leading to unauthorized access to sensitive information.

Vulnerebility

CVE

Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain regular shell access.

Vulnerebility

CVE

Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges may be able to inject malicious code into user profile configurations due to improper input sanitization.

Vulnerebility

CVE

Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain root access to the system.

Vulnerebility

CVE

An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.1.0 through 7.1.1 and 7.0.0 through 7.0.2 and 6.7.0 through 6.7.8 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.2 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via via crafted API requests.

Vulnerebility

CVE

An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.1.0 through 7.1.1 and 7.0.0 through 7.0.2 and 6.7.0 through 6.7.8 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.2 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via via crafted API requests.

Vulnerebility

CVE

A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.

Vulnerebility

CVE

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device.

Vulnerebility

CVE

Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks that perform arbitrary actions on an affected device.

BOTNET

BOTNET

KV-Botnet: Don’t Call It A Comeback

Vulnerebility

CVE

(CVSS score: 5.3) - Out-of-bounds read when printing error messages, resulting in a denial-of-service (DoS) condition

Vulnerebility

CVE

(CVSS score: 7.4) - Buffer overflow in shim when compiled for 32-bit processors that can lead to a crash or data integrity issues during the boot phase

Vulnerebility

CVE

(CVSS score: 5.5) - Out-of-bounds read in the authenticode function that could permit an attacker to trigger a DoS by providing a malformed binary

Vulnerebility

CVE

(CVSS score: 5.5) - Out-of-bounds read when validating Secure Boot Advanced Targeting (SBAT) information that could result in information disclosure

Vulnerebility

CVE

(CVSS score: 7.1) - Out-of-bounds read when parsing MZ binaries, leading to a crash or possible exposure of sensitive data

Malware

Backdoor

According to Mandiant, this malware family is attributed to potential chinese background and its Linux variant is related to exploitation of Fortinet's SSL-VPN (CVE-2022-42475).

Malware

ELF

According to Mandiant, this malware family is attributed to potential chinese background and directly related to observed exploitation of Fortinet's SSL-VPN (CVE-2022-42475). There is also a Windows variant.

Malware

RAT

Successful exploitation of the flaw paved the way for the deployment of a backdoor dubbed COATHANGER from an actor-controlled server that's designed to grant persistent remote access to the compromised appliances.

Vulnerebility

CVE

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response.

Vulnerebility

CVE

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

Malware

Stealer

CrackedCantil: A Malware Symphony Breakdown

Malware

Stealer

Facebook Advertising Spreads Novel Malware Variant

Vulnerebility

CVE

(CVSS score: 7.2) - Azure HDInsight Apache Ambari Java Database Connectivity (JDBC) Injection Elevation of Privilege Vulnerability

Vulnerebility

CVE

(CVSS score: 8.8) - Azure HDInsight Apache Oozie Workflow Scheduler XML External Entity (XXE) Injection Elevation of Privilege Vulnerability

Group

Group

Analysis of TTPs tied to GambleForce, which carried out SQL injection attacks against companies in the APAC region

Vulnerebility

CVE

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Vulnerebility

CVE

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Malware

Spyware

A Spyware Vendor Seemingly Made a Fake WhatsApp to Hack Targets

Malware

Android

Skygofree: Following in the footsteps of HackingTeam

Malware

RAT

ESET researchers discovered several Android apps carrying VajraSpy, a RAT used by the Patchwork APT group

Malware

Spyware

New spyware attacks exposed: civil society targeted in Jordan

Malware

Loader

This report aims to detail the functioning of a malware used by FIN7 since 2021, named DiceLoader (also known Icebot), and to provide a comprehensive approach of the threat by detailing the related Techniques...

Malware

Stealer

CVE-2023-36025 Exploited for Defense Evasion in Phemedrone Stealer Campaign

Malware

Stealer

Unit 42 researchers recently discovered activity attributed to Mispadu Stealer, a stealthy infostealer first reported in 2019

Vulnerebility

CVE

Windows SmartScreen Security Feature Bypass Vulnerability

3.2.24

Incident

Incident

Thanksgiving 2023 security incident

3.2.24

Incident

Incident

Following indications of an incident on some of our systems, we conducted a security audit and found evidence of compromised production systems. We immediately activated a remediation and response plan involving cyber security experts CrowdStrike. The remediation plan has concluded successfully.

3.2.24

Vulnerebility

CVE

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication.

3.2.24

Exploit

WebApps

PHP

3.2.24

Exploit

WebApps

Hardware

3.2.24

Exploit

DoS

Hardware

3.2.24

Exploit

WebApps

Hardware

3.2.24

Exploit

WebApps

Hardware

3.2.24

Exploit

WebApps

Hardware

3.2.24

Exploit

WebApps

Hardware

3.2.24

Exploit

WebApps

Hardware

3.2.24

Exploit

WebApps

Hardware

3.2.24

Exploit

Remote

Windows

3.2.24

Exploit

WebApps

PHP

3.2.24

Exploit

Remote

Windows

Group

Group

The Coldriver Group, also known as Callisto and SEABORGIUM, is a threat actor known to attack government organizations, think tanks, and journalists in Europe and the Caucasus regions through spearphishing campaigns.

Malware

Backdoor

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

CVE

Microsoft Outlook Elevation of Privilege Vulnerability

Group

Group

Shuckworm: Inside Russia’s Relentless Cyber Campaign Against Ukraine

Attack

Attack

NTLM relay attacks A dangerous game of hot potato

Group

Group

Malware Spotlight – Into the Trash: Analyzing LitterDrifter

Group

Group

UAC-0027 Attack Detection: Hackers Target Ukrainian Organizations Using DIRTYMOE (PURPLEFOX) Malware

Malware

Backdoor

Securonix Threat Research Security Advisory: Analysis and Detection of STEADY#URSA Attack Campaign Targeting Ukraine Military Dropping New Covert SUBTLE-PAWS PowerShell Backdoor

2.2.24

Exploit

Remote

macOS

2.2.24

Exploit

Remote

Linux

2.2.24

Exploit

WebApps

Multiple

2.2.24

Exploit

WebApps

PHP

2.2.24

Exploit

WebApps

PHP

2.2.24

Exploit

WebApps

PHP

2.2.24

Exploit

WebApps

PHP

CyberSpy

UNC5221: Unreported and Undetected WIREFIRE Web Shell Variant

Botnet

Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal

Rootkit

We discuss proof-of-concept rootkits and malware used by cybercriminals in conjunction with Berkeley Packet Filtering (BPF), a piece of technology that allows programs to execute code in the operating systems of popular cloud-computing platforms. We also show how to detect such threats.

Cryptocurrency

The Nine Lives of Commando Cat: Analysing a Novel Malware Campaign Targeting Docker

Group

[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

HeadCrab 2.0: Evolving Threat in Redis Malware Landscape

CVE

A type confusion issue was addressed with improved checks. This issue is fixed in tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3, macOS Ventura 13.6.4, macOS Monterey 12.7.3.

CVE

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2.

CVE

'Leaky Vessels' Cloud Bugs Allow Container Escapes Globally

CVE

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

CVE

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

CVE

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.

CVE

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

CVE

A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.

BOTNET

Bot

Telekopye: Hunting Mammoths using Telegram bot

Operation

Phishing

“Scammers Paradise” —Exploring Telegram’s Dark Markets, Breeding Ground for Modern Phishing Operations

Malware

Python

Evolution of UNC4990: Uncovering USB Malware's Hidden Depths

Malware

Backdoor

Mandiant has observed UNC4990 leverage EMPTYSPACE (also known as VETTA Loader and BrokerLoader), a downloader that can execute any payload served by the command and control (C2) server, and QUIETBOARD, which is a backdoor that was delivered using EMPTYSPACE.

Group

Group

Evolution of UNC4990: Uncovering USB Malware's Hidden Depths

REPORT

Report

2023 Adversary Infrastructure Report

Malware

Loader

KRUSTYLOADER - RUST MALWARE LINKED TO IVANTI CONNECTSECURE COMPROMISES

CVE

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

CVE

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

CVE

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable.

CVE

An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions.

CVE

An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library.

CVE

A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions