‼ CVE-2021-23275 ‼
📖 Read
via "National Vulnerability Database".
The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29480 ‼
📖 Read
via "National Vulnerability Database".
Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used (which is recommended, but is not on by default), the session data could be tampered with by someone with the ability to write cookies. The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible, but its use is not actively prevented. As of Ratpack 1.9.0, the default value is a securely randomly generated value, generated at application startup time. As a workaround, supply an alternative signing key, as per the documentation's recommendation.📖 Read
via "National Vulnerability Database".
🕴 Ransomware Losses Drive Up Cyber-Insurance Costs 🕴
📖 Read
via "Dark Reading".
Premiums have gone up by 7% on average for small firms and between 10% and 40% for medium and large businesses.📖 Read
via "Dark Reading".
🕴 Google Updates Vulnerability Data Format to Support Automation 🕴
📖 Read
via "Dark Reading".
The Open Source Vulnerability schema supports automated vulnerability handling in Go, Rust, Python, and Distributed Weakness Filing system, and it could be the favored format for future exporting of data.📖 Read
via "Dark Reading".
Dark Reading
Google Updates Vulnerability Data Format to Support Automation
The Open Source Vulnerability schema supports automated vulnerability handling in Go, Rust, Python, and Distributed Weakness Filing system, and it could be the favored format for future exporting of data.
‼ CVE-2021-22329 ‼
📖 Read
via "National Vulnerability Database".
There has a license management vulnerability in some Huawei products. An attacker with high privilege needs to perform specific operations to exploit the vulnerability on the affected device. Due to improper license management of the device, as a result, the license file can be applied and affect integrity of the device. Affected product versions include:S12700 V200R007C01,V200R007C01B102,V200R008C00,V200R010C00SPC300,V200R011C00,V200R011C00SPC100,V200R011C10;S1700 V200R010C00SPC300,V200R011C00,V200R011C00SPC100,V200R011C10;S2700 V200R008C00,V200R010C00SPC300,V200R011C00,V200R011C00SPC100,V200R011C10;S5700 V200R008C00,V200R010C00SPC300,V200R011C00,V200R011C00SPC100,V200R011C10,V200R011C10SPC100;S6700 V200R008C00,V200R010C00SPC300,V200R011C00,V200R011C00SPC100,V200R011C10,V200R011C10SPC100;S7700 V200R008C00,V200R010C00SPC300,V200R011C00,V200R011C00SPC100,V200R011C10;S9700 V200R007C01,V200R007C01B102,V200R008C00,V200R010C00SPC300,V200R011C00,V200R011C00SPC100,V200R011C10.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22341 ‼
📖 Read
via "National Vulnerability Database".
There is a memory leak vulnerability in Huawei products. A resource management weakness exists in a module. Attackers with high privilege can exploit this vulnerability by performing some operations. This can lead to memory leak. Affected product versions include:IPS Module V500R005C00SPC100,V500R005C00SPC200;NGFW Module V500R005C00SPC100,V500R005C00SPC200;NIP6300 V500R005C00SPC100,V500R005C10SPC200;NIP6600 V500R005C00SPC100,V500R005C00SPC200;Secospace USG6300 V500R005C00SPC100,V500R005C00SPC200;Secospace USG6500 V500R005C00SPC100,V500R005C10SPC200;Secospace USG6600 V500R005C00SPC100,V500R005C00SPC200.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35959 ‼
📖 Read
via "National Vulnerability Database".
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.📖 Read
via "National Vulnerability Database".
🦿 Windows 11: Understanding the system requirements and the security benefits 🦿
📖 Read
via "Tech Republic".
Security is a big part of Windows 11, but so is delivering productivity and a good experience with all the security features turned on.📖 Read
via "Tech Republic".
TechRepublic
Windows 11: Understanding the system requirements and the security benefits
Security is a big part of Windows 11, but so is delivering productivity and a good experience with all the security features turned on.
‼ CVE-2021-32566 ‼
📖 Read
via "National Vulnerability Database".
Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35474 ‼
📖 Read
via "National Vulnerability Database".
Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.📖 Read
via "National Vulnerability Database".
⚠ Police warn of WhatsApp scams in time for Social Media Day ⚠
📖 Read
via "Naked Security".
Happy Social Media Day! Make it a day to review whether your social media security really is up to scratch.📖 Read
via "Naked Security".
Naked Security
Police warn of WhatsApp scams in time for Social Media Day
Happy Social Media Day! Make it a day to review whether your social media security really is up to scratch.
‼ CVE-2021-34383 ‼
📖 Read
via "National Vulnerability Database".
Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow might lead to denial of service or escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-28692 ‼
📖 Read
via "National Vulnerability Database".
inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34385 ‼
📖 Read
via "National Vulnerability Database".
Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calculation of a length could lead to a heap overflow.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34373 ‼
📖 Read
via "National Vulnerability Database".
Trusty trusted Linux kernel (TLK) contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflows, which might lead to information disclosure and denial of service.📖 Read
via "National Vulnerability Database".
❌ Feds Told to Better Manage Facial Recognition, Amid Privacy Concerns ❌
📖 Read
via "Threat Post".
A GAO report finds government agencies are using the technology regularly in criminal investigations and to identify travelers, but need stricter management to protect people’s privacy and avoid inaccurate identification📖 Read
via "Threat Post".
Threat Post
Feds Told to Better Manage Facial Recognition, Amid Privacy Concerns
A GAO report finds government agencies are using the technology regularly in criminal investigations and to identify travelers, but need stricter management to protect people’s privacy and avoid inaccurate identification
🕴 9 Hot Trends in Cybersecurity Mergers & Acquisitions 🕴
📖 Read
via "Dark Reading".
Security experts share their observations of the past year in cybersecurity M&A, highlighting key trends and notable deals.📖 Read
via "Dark Reading".
Dark Reading
9 Hot Trends in Cybersecurity Mergers & Acquisitions
Security experts share their observations of the past year in cybersecurity M&A, highlighting key trends and notable deals.
🦿 Ransomware experts urge victims not to pay, but are they listening? 🦿
📖 Read
via "Tech Republic".
The number of attacks from, and payouts to, ransomware extortionists continue to rise despite only 20% saying giving into demands is the best course, Menlo Security finds.📖 Read
via "Tech Republic".
TechRepublic
Ransomware experts urge victims not to pay, but are they listening?
The number of attacks from, and payouts to, ransomware extortionists continue to rise despite only 20% saying giving into demands is the best course, Menlo Security finds.
‼ CVE-2021-27902 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27903 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).📖 Read
via "National Vulnerability Database".
⚠ Colombian police arrest Gozi malware suspect after 8 years at large ⚠
📖 Read
via "Naked Security".
Safe at home, apparently, but not so safe overseas.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News