Calenderweek 35 – WafdogBlog

Addressing Splunk Enterprise Vulnerabilities: Patching Cross-Site Scripting, Denial of Service, and More

Splunk Enterprise harbors multiple vulnerabilities, including Cross-site Scripting (XSS), Denial of Service (DoS), Remote Code Execution, Privilege Escalation, and Path Traversal, with severity ratings ranging from 6.3 (Medium) to 8.8 (High). Addressing these concerns, Splunk has issued security advisories detailing patches for these vulnerabilities. CVE-2023-40592: Reflected Cross-Site Scripting (XSS) This vulnerability permits attackers to execute …

Addressing Splunk Enterprise Vulnerabilities: Patching Cross-Site Scripting, Denial of Service, and More Read More »

VMware Vulnerability Report: SAML Token Signature Bypass and Mitigation Measures

A vulnerability affecting VMware involving a SAML token signature bypass has been reported, potentially allowing threat actors to execute VMware Guest operations. Assigned the CVE ID CVE-2023-20900, this vulnerability is classified with a severity rating of 7.5 (High). VMware tools encompass a suite of modules and services designed to enhance various functionalities within VMware products. …

VMware Vulnerability Report: SAML Token Signature Bypass and Mitigation Measures Read More »

ArubaOS-Switch Vulnerabilities: Risks and Remediation Measures

ArubaOS-Switch Switches have been found to contain multiple vulnerabilities, including Stored Cross-site Scripting (Stored XSS), Denial of Service (DoS), and Memory Corruption issues. Aruba, the owner of ArubaOS-Switch and a subsidiary of Hewlett Packard Enterprise, has taken steps to address these vulnerabilities and has released a security advisory. ArubaOS-Switch allows centralized network management and is …

ArubaOS-Switch Vulnerabilities: Risks and Remediation Measures Read More »

Skype Security Alert: Flaw Exposes Users’ IP Addresses

A serious security flaw in Microsoft’s Skype messenger allows attackers to easily spy on your IP address. Using Skype? Then you should be particularly cautious now! A security researcher has managed to find out the IP address of a Skype user without them having to click on a link. Sounds alarming, doesn’t it? In this …

Skype Security Alert: Flaw Exposes Users’ IP Addresses Read More »

New Evasion Technique: Hackers Embed Malicious Word Files within PDFs

In an attempt to evade detection, hackers have adopted a novel technique known as “MalDoc in PDF,” wherein they embed a malicious Word file within a PDF file. Despite possessing PDF-specific file format and magic numbers, a file crafted with MalDoc in PDF can be opened in Word. When such a file contains a configured …

New Evasion Technique: Hackers Embed Malicious Word Files within PDFs Read More »