‼ CVE-2021-22377 ‼
📖 Read
via "National Vulnerability Database".
There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify specific input sufficiently. Attackers can exploit this vulnerability by sending malicious parameters to inject command. This can compromise normal service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22382 ‼
📖 Read
via "National Vulnerability Database".
Huawei LTE USB Dongle products have an improper permission assignment vulnerability. An attacker can locally access and log in to a PC to induce a user to install a specially crafted application. After successfully exploiting this vulnerability, the attacker can perform unauthenticated operations. Affected product versions include:E3372 E3372h-153TCPU-V200R002B333D01SP00C00.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22361 ‼
📖 Read
via "National Vulnerability Database".
There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200. A file access is not authorized correctly. Attacker with low access may launch privilege escalation in a specific scenario. This may compromise the normal service.📖 Read
via "National Vulnerability Database".
❌ BEC Losses Top $1.8B as Tactics Evolve ❌
📖 Read
via "Threat Post".
BEC attacks getting are more dangerous, and smart users are the ones who can stop it.📖 Read
via "Threat Post".
Threat Post
BEC Losses Top $1.8B as Tactics Evolve
BEC attacks getting are more dangerous, and smart users are the ones who can stop it.
‼ CVE-2021-32699 ‼
📖 Read
via "National Vulnerability Database".
Wings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding. Users should upgrade to `1.4.4` to mitigate the issue. There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32700 ‼
📖 Read
via "National Vulnerability Database".
Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.x and SL releases up to alpha 3 have a potential for a supply chain attack via MiTM against users. Http connections did not make use of TLS and certificate checking was ignored. The vulnerability allows an attacker to substitute or modify packages retrieved from BC thus allowing to inject malicious code into ballerina executables. This has been patched in Ballerina 1.2.14 and Ballerina SwanLake alpha4.📖 Read
via "National Vulnerability Database".
🦿 Data resiliency is key to surviving a ransomware attack, expert says 🦿
📖 Read
via "Tech Republic".
It's not "if" but "when" you'll be attacked, cybersecurity expert says. Checking on your data and backups is something businesses should do regularly.📖 Read
via "Tech Republic".
TechRepublic
Data resiliency is key to surviving a ransomware attack, expert says
It's not "if" but "when" you'll be attacked, cybersecurity expert says. Checking on your data and backups is something businesses should do regularly.
🦿 How to be prepared for a ransomware attack: Check your data and backups 🦿
📖 Read
via "Tech Republic".
Expert says ransomware attacks will happen, and your company has to be prepared long before the attack hits.📖 Read
via "Tech Republic".
TechRepublic
How to be prepared for a ransomware attack: Check your data and backups
Expert says ransomware attacks will happen, and your company has to be prepared long before the attack hits.
🕴 Despite Heightened Cyber-Risks, Few Security Leaders Report to CEO 🕴
📖 Read
via "Dark Reading".
A new report suggests that top management at most companies still don't get security.📖 Read
via "Dark Reading".
‼ CVE-2021-34391 ‼
📖 Read
via "National Vulnerability Database".
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel�s tz_handle_trusted_app_smc function where a lack of integer overflow checks on the req_off and param_ofs variables leads to memory corruption of critical kernel structures.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34396 ‼
📖 Read
via "National Vulnerability Database".
Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, which would result in limited denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34393 ‼
📖 Read
via "National Vulnerability Database".
Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command. This vulnerability might allow an attacker to exploit the deserializer to impact code execution, causing information disclosure.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34395 ‼
📖 Read
via "National Vulnerability Database".
Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user with local privileges, which might lead to limited information disclosure and limited denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34397 ‼
📖 Read
via "National Vulnerability Database".
Bootloader contains a vulnerability in NVIDIA MB2, which may cause free-the-wrong-heap, which may lead to limited denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34392 ‼
📖 Read
via "National Vulnerability Database".
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundary checks, which might lead to denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34390 ‼
📖 Read
via "National Vulnerability Database".
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow on the size parameter of the tz_map_shared_mem function.📖 Read
via "National Vulnerability Database".
❌ SonicWall ‘Botches’ October Patch for Critical VPN Bug ❌
📖 Read
via "Threat Post".
Company finally rolls out the complete fix this week for an RCE flaw affecting some 800,000 devices that could result in crashes or prevent users from connecting to corporate resources.📖 Read
via "Threat Post".
Threat Post
SonicWall ‘Botches’ October Patch for VPN Bug
Company finally rolls out the complete fix this week for a flaw affecting some 800,000 devices that could result in crashes or prevent users from connecting to corporate resources.
‼ CVE-2021-35210 ‼
📖 Read
via "National Vulnerability Database".
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29084 ‼
📖 Read
via "National Vulnerability Database".
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report management component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to read arbitrary files via unspecified vectors.📖 Read
via "National Vulnerability Database".
❌ Unpatched Linux Marketplace Bugs Allow Wormable Attacks, Drive-By RCE ❌
📖 Read
via "Threat Post".
A pair of zero-days affecting Pling-based marketplaces could allow for some ugly attacks on unsuspecting Linux enthusiasts -- with no patches in sight.📖 Read
via "Threat Post".
Threat Post
Unpatched Linux Marketplace Bugs Allow Wormable Attacks, Drive-By RCE
A pair of zero-days affecting Pling-based marketplaces could allow for some ugly attacks on unsuspecting Linux enthusiasts — with no patches in sight.
🕴 Expecting the Unexpected: Tips for Effectively Mitigating Ransomware Attacks in 2021 🕴
📖 Read
via "Dark Reading".
Cybercriminals continually innovate to thwart security protocols, but organizations can take steps to prevent and mitigate ransomware attacks.📖 Read
via "Dark Reading".