article thumbnail

Experts warn of critical Zero-Day in Apache OfBiz

Security Affairs

. “As a result, like with many supply chain libraries, the impact of this vulnerability could be severe if leveraged by threat actors.” ” reads the report published by SonicWall. For this reason, removing the XML RPC code did not completely patch the flaw.

article thumbnail

Researchers created a PoC for Apache OFBiz flaw CVE-2023-51467

Security Affairs

“As a result, like with many supply chain libraries, the impact of this vulnerability could be severe if leveraged by threat actors.” reads the report published by SonicWall. For this reason, removing the XML RPC code did not completely patch the flaw.

Honeypots 126
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Free Download Manager backdoored to serve Linux malware for more than 3 years

Security Affairs

The executable is a backdoor that accesses the Linux API and invokes syscalls using the statically linked dietlibc library. “While checking videos on Free Download Manager that are hosted on YouTube, we identified several tutorials demonstrating how to install this software on Linux machines.” ” continues the report.

Cloud 117
article thumbnail

Vulnerability Recap 4/1/24: Cisco, Fortinet & Windows Server Updates

eSecurity Planet

or above March 25, 2024 Hackers Pollute Python Package Index Open-Source Libraries Type of vulnerability (or attack): Malicious library code. Checkmarx estimates over 170,000 developers use affected libraries and might possess corrupted code. The fix: Update affected versions ASAP: FortiClient EMS 7.2: Upgrade versions 7.2.0

Libraries 106
article thumbnail

OnionPoison: malicious Tor Browser installer served through a popular Chinese YouTube channel

Security Affairs

The channel has more than 180,000 subscribers and according to Kaspersky the video with the malicious link had more than 64,000 views at the time of the discovery. The video was posted on January 2022, and according to Kaspersky’s telemetry, the first victims were compromised in March 2022. ” concludes the report.

article thumbnail

Erbium info-stealing malware, a new option in the threat landscape

Security Affairs

The recently discovered Erbium information-stealer is being distributed as fake cracks and cheats for popular video games. Threat actors behind the new ‘Erbium’ information-stealing malware are distributing it as fake cracks and cheats for popular video games to steal victims’ credentials and cryptocurrency wallets.

article thumbnail

GhostTouch: how to remotely control touchscreens with EMI

Security Affairs

We show the real-world impact of the GhostTouch attacks in a few proof-of-concept scenarios, including answering an eavesdropping phone call, pressing the button, swiping up to unlock, and entering a password.” ” reads the research paper published by the academics. Redmi 8, and an iPhone SE (2020). ” concludes the paper.

Paper 144