In computing, syslog is a standard for message logging. It allows separation of the software that generates messages, the system that stores them, and the software that reports and analyzes them. Each message is labeled with a facility code, indicating the type of system generating the message, and is assigned...
Blog
ChatGPT Popularity Spurs Poisoning and Phishing Attacks
ChatGPT, the popular chat-based artificial intelligence platform, is becoming a target for malicious actors. Poisoning and phishing attacks are on the rise as more people use the platform for personal and business purposes. Poisoning Attack Targeting Open-Sourced ChatGPT Project A threat actor forked a very popular open-source ChatGPT desktop application...
Node.js Authentication Bypass Vulnerability (CVE-2023-23918) Notice
Overview Recently, NSFOCUS CERT detected that Node.js officially fixed an authentication vulnerability (CVE-2023-23918). Due to the flaw of improper permission control in Node.js, a remote attacker can use the process.mainModule.require() function to bypass permissions and access unauthorized modules. The official said that this vulnerability only affects users who have enabled...
Multiple Security Vulnerabilities in Google Chrome
Overview Recently, NSFOCUS CERT detected that Google Chrome officially released a security bulletin, which fixed multiple security vulnerabilities. The key vulnerabilities are as follows: Google Chrome use-after-free vulnerability (CVE-2023-0927): Due to a use-after-free flaw in the Web Payments API in Google Chrome, a remote attacker capable of compromising the renderer...
VMware Carbon Black App Control Remote Code Execution Vulnerability (CVE-2023-20858) Notification
Overview Recently, NSFOCUS CERT found that VMware has officially fixed an App Control injection vulnerability (CVE-2023-20858). Due to flaws in product verification of user-input content, attackers with App Control management console permissions can access the underlying server operating system by entering specially crafted data, and ultimately achieve arbitrary code execution...
Joomla Unauthorized Access Vulnerability (CVE-2023-23752) Notice
Overview Recently, Joomla officially released a security update notice to fix a Joomla unauthorized access vulnerability (CVE-2023-23752), which was submitted by a researcher of NSFOCUS Tianji Lab. Due to flaws in Joomla's access control to Web service endpoints, unauthenticated attackers access the RestAPI interface to obtain Joomla-related configuration information by...
