‼ CVE-2020-28500 ‼
📖 Read
via "National Vulnerability Database".
All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Steps to reproduce (provided by reporter Liyuan Chen): var lo = require('lodash'); function build_blank (n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0) var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1) var time2 = Date.now(); lo.trimEnd(s) var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2)📖 Read
via "National Vulnerability Database".
🕴 How to Submit a Column to Dark Reading 🕴
📖 Read
via "Dark Reading".
Have a new idea, a lesson learned, or a call to action for your fellow cybersecurity professionals? Here's how to submit your Commentary pieces to Dark Reading.📖 Read
via "Dark Reading".
Dark Reading
How to Submit a Column to Dark Reading
Have a new idea, a lesson learned, or a call to action for your fellow cybersecurity professionals? Here's how to submit your Commentary pieces to Dark Reading.
🕴 100+ Financial Services Firms Targeted in Ransom DDoS Attacks in 2020 🕴
📖 Read
via "Dark Reading".
Consumer banks, exchanges, payment firms, and card issuing companies around the globe were among those hit.📖 Read
via "Dark Reading".
Dark Reading
100+ Financial Services Firms Targeted in Ransom DDoS Attacks in 2020
Consumer banks, exchanges, payment firms, and card issuing companies around the globe were among those hit.
âš Egregor ransomware criminals allegedly busted in Ukraine âš
📖 Read
via "Naked Security".
More good news in the cybercrime law-and-order world, this time a bust of ransomware crooks.📖 Read
via "Naked Security".
Naked Security
Egregor ransomware criminals allegedly busted in Ukraine
More good news in the cybercrime law-and-order world, this time a bust of ransomware crooks.
🕴 Malware Exploits Security Teams' Greatest Weakness: Poor Relationships With Employees 🕴
📖 Read
via "Dark Reading".
Users' distrust of corporate security teams is exposing businesses to unnecessary vulnerabilities.📖 Read
via "Dark Reading".
Dark Reading
Malware Exploits Security Teams' Greatest Weakness: Poor Relationships With Employees
Users' distrust of corporate security teams is exposing businesses to unnecessary vulnerabilities.
‼ CVE-2021-25296 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25299 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23337 ‼
📖 Read
via "National Vulnerability Database".
All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Command Injection via template.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23336 ‼
📖 Read
via "National Vulnerability Database".
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25297 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25298 ‼
📖 Read
via "National Vulnerability Database".
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.📖 Read
via "National Vulnerability Database".
âš Naked Security Live – When is a bug bounty not a bug bounty? âš
📖 Read
via "Naked Security".
Latest episode - watch now!📖 Read
via "Naked Security".
Naked Security
Naked Security Live – When is a bug bounty not a bug bounty?
Latest episode – watch now!
‼ CVE-2020-4956 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote attacker could exploit this vulnerability to cause the consumption of all memory resources. IBM X-Force ID: 192156.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29031 ‼
📖 Read
via "National Vulnerability Database".
An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35775 ‼
📖 Read
via "National Vulnerability Database".
CITSmart before 9.1.2.23 allows LDAP Injection.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-29026 ‼
📖 Read
via "National Vulnerability Database".
A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4955 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validation. By creating an unspecified servlet request with specially crafted input parameters, an attacker could exploit this vulnerability to load a malicious .dll with elevated privileges. IBM X-Force ID: 192155.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-4954 ‼
📖 Read
via "National Vulnerability Database".
IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could exploit this vulnerability to bypass authentication and gain access to a limited number of debug functions, such as logging levels. IBM X-Force ID: 192153.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23338 ‼
📖 Read
via "National Vulnerability Database".
This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.📖 Read
via "National Vulnerability Database".
🦿 Linux 101: How to remove legacy communication services 🦿
📖 Read
via "Tech Republic".
To keep your Linux servers and desktops as secure as possible, you should check for (and remove) legacy communication services. Jack Wallen shows you how.📖 Read
via "Tech Republic".
TechRepublic
Linux 101: How to remove legacy communication services
To keep your Linux servers and desktops as secure as possible, you should check for (and remove) legacy communication services. Jack Wallen shows you how.
‼ CVE-2021-27218 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.📖 Read
via "National Vulnerability Database".