‼ CVE-2020-8030 ‼
📖 Read
via "National Vulnerability Database".
A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-8031 ‼
📖 Read
via "National Vulnerability Database".
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prior to 2.10.8.📖 Read
via "National Vulnerability Database".
🕴 7 Things We Know So Far About the SolarWinds Attacks 🕴
📖 Read
via "Dark Reading".
Two months after the news first broke, many questions remain about the sophisticated cyber-espionage campaign.📖 Read
via "Dark Reading".
Dark Reading
7 Things We Know So Far About the SolarWinds Attacks
Two months after the news first broke, many questions remain about the sophisticated cyber-espionage campaign.
🕴 Game Over: Stopping DDoS Attacks Before They Start 🕴
📖 Read
via "Dark Reading".
Video games are poised for a revolution, but benefits will come to fruition only if the industry can guarantee consistent performance and availability.📖 Read
via "Dark Reading".
Dark Reading
Game Over: Stopping DDoS Attacks Before They Start
Video games are poised for a revolution, but benefits will come to fruition only if the industry can guarantee consistent performance and availability.
🦿 How to use the Vault command line tool to store your code secrets 🦿
📖 Read
via "Tech Republic".
Developers must stop saving secrets in code. One way to avoid that is to use HashiCorp's Vault. Jack Wallen shows you how to install this tool and take your first steps in its usage.📖 Read
via "Tech Republic".
TechRepublic
How to use the Vault command line tool to store your code secrets
Developers must stop saving secrets in code. One way to avoid that is to use HashiCorp's Vault. Jack Wallen shows you how to install this tool and take your first steps in its usage.
🔏 FBI Urges Caution with Legacy Systems Following Water Hack 🔏
📖 Read
via "Digital Guardian".
The FBI reiterated that using end-of-life operating systems and desktop sharing software can open the doors for attackers, like in the Oldsmar water treatment plant hack.📖 Read
via "Digital Guardian".
Digital Guardian
FBI Urges Caution with Legacy Systems Following Water Hack
The FBI reiterated that using end-of-life operating systems and desktop sharing software can open the doors for attackers, like in the Oldsmar water treatment plant hack.
🕴 Microsoft Launches Phase 2 Mitigation for Zerologon Flaw 🕴
📖 Read
via "Dark Reading".
The Netlogon remote code execution vulnerability, disclosed last August, has been weaponized by APT groups.📖 Read
via "Dark Reading".
Darkreading
Microsoft Launches Phase 2 Mitigation for Zerologon Flaw
The Netlogon remote code execution vulnerability, disclosed last August, has been weaponized by APT groups.
‼ CVE-2020-13185 ‼
📖 Read
via "National Vulnerability Database".
Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21301 ‼
📖 Read
via "National Vulnerability Database".
Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerability where the video capture isn't stopped in a scenario where a user first has their camera enabled and then disables it. It's a privacy issue because video is streamed to the call when the user believes it is disabled. It impacts all users in video calls. This is fixed in version 3.75.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-25493 ‼
📖 Read
via "National Vulnerability Database".
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21299 ‼
📖 Read
via "National Vulnerability Database".
hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smuggling" or "desync attacks". To determine if vulnerable, all these things must be true: 1) Using hyper as an HTTP server (the client is not affected), 2) Using HTTP/1.1 (HTTP/2 does not use transfer-encoding), 3) Using a vulnerable HTTP proxy upstream to hyper. If an upstream proxy correctly rejects the illegal transfer-encoding headers, the desync attack cannot succeed. If there is no proxy upstream of hyper, hyper cannot start the desync attack, as the client will repair the headers before forwarding. This is fixed in versions 0.14.3 and 0.13.10. As a workaround one can take the following options: 1) Reject requests that contain a `transfer-encoding` header, 2) Ensure any upstream proxy handles `transfer-encoding` correctly.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22881 ‼
📖 Read
via "National Vulnerability Database".
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25689 ‼
📖 Read
via "National Vulnerability Database".
An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22656 ‼
📖 Read
via "National Vulnerability Database".
Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-13186 ‼
📖 Read
via "National Vulnerability Database".
An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with knowledge of both a machineID and user GUID to modify data if a user clicked a malicious link.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25690 ‼
📖 Read
via "National Vulnerability Database".
A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27191 ‼
📖 Read
via "National Vulnerability Database".
The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25688 ‼
📖 Read
via "National Vulnerability Database".
Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21.01.0 may log parts of a user's password in the application logs.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-1717 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-10734 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22880 ‼
📖 Read
via "National Vulnerability Database".
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.📖 Read
via "National Vulnerability Database".