‼ CVE-2021-29106 ‼
📖 Read
via "National Vulnerability Database".
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29103 ‼
📖 Read
via "National Vulnerability Database".
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29105 ‼
📖 Read
via "National Vulnerability Database".
A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22917 ‼
📖 Read
via "National Vulnerability Database".
Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was enabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-27293 ‼
📖 Read
via "National Vulnerability Database".
RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.📖 Read
via "National Vulnerability Database".
🕴 Navigating Active Directory Security: Dangers and Defenses 🕴
📖 Read
via "Dark Reading".
Microsoft Active Directory, ubiquitous across enterprises, has long been a primary target for attackers seeking network access and sensitive data.📖 Read
via "Dark Reading".
Dark Reading
Navigating Active Directory Security: Dangers and Defenses
Microsoft Active Directory, ubiquitous across enterprises, has long been a primary target for attackers seeking network access and sensitive data.
‼ CVE-2021-30129 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32679 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, filenames where not escaped by default in controllers using `DownloadResponse`. When a user-supplied filename was passed unsanitized into a `DownloadResponse`, this could be used to trick users into downloading malicious files with a benign file extension. This would show in UI behaviours where Nextcloud applications would display a benign file extension (e.g. JPEG), but the file will actually be downloaded with an executable file extension. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. Administrators of Nextcloud instances do not have a workaround available, but developers of Nextcloud apps may manually escape the file name before passing it into `DownloadResponse`.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32678 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.0.11, and 21.0.3, ratelimits are not applied to OCS API responses. This affects any OCS API controller (`OCSController`) using the `@BruteForceProtection` annotation. Risk depends on the installed applications on the Nextcloud Server, but could range from bypassing authentication ratelimits or spamming other Nextcloud users. The vulnerability is patched in versions 19.0.13, 20.0.11, and 21.0.3. No workarounds aside from upgrading are known to exist.📖 Read
via "National Vulnerability Database".
🕴 AI and Cybersecurity: Making Sense of the Confusion 🕴
📖 Read
via "Dark Reading".
Artificial intelligence is a maturing area in cybersecurity, but there are different concerns depending on whether you're a defender or an attacker.📖 Read
via "Dark Reading".
Dark Reading
AI and Cybersecurity: Making Sense of the Confusion
Artificial intelligence is a maturing area in cybersecurity, but there are different concerns depending on whether you're a defender or an attacker.
🕴 Kaseya Releases Security Patch As Companies Continue to Recover 🕴
📖 Read
via "Dark Reading".
Estimates indicate the number of affected companies could grow, while Kaseya faces renewed scrutiny as former employees reportedly criticize its lack of focus on security.📖 Read
via "Dark Reading".
Dark Reading
Kaseya Releases Security Patch as Companies Continue to Recover
Estimates indicate the number of affected companies could grow, while Kaseya faces renewed scrutiny as former employees reportedly criticize its lack of focus on security.
❌ Kaseya Patches Zero-Days Used in REvil Attacks ❌
📖 Read
via "Threat Post".
The security update addresses three VSA vulnerabilities used by the ransomware gang to launch a worldwide supply-chain attack on MSPs and their customers.📖 Read
via "Threat Post".
Threat Post
Kaseya Patches Zero-Days Used in REvil Attacks
The security update addresses three VSA vulnerabilities used by the ransomware gang to launch a worldwide supply-chain attack on MSPs and their customers.
‼ CVE-2021-30639 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36382 ‼
📖 Read
via "National Vulnerability Database".
Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext).📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18979 ‼
📖 Read
via "National Vulnerability Database".
Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via theX-forwarded-for Header parameter.📖 Read
via "National Vulnerability Database".
⚠ Where do all those cybercrime payments go? ⚠
📖 Read
via "Naked Security".
Yes, the headline is a rhetorical question. But sometimes we get literal answers, and they're well worth remembering.📖 Read
via "Naked Security".
Naked Security
Where do all those cybercrime payments go?
Yes, the headline is a rhetorical question. But sometimes we get literal answers, and they’re well worth remembering.
🦿 The most dangerous messaging apps on Android 🦿
📖 Read
via "Tech Republic".
Messaging apps are becoming some of the most popular smartphone programs in the world, and that means more attempts to phish their users, Kaspersky finds.📖 Read
via "Tech Republic".
TechRepublic
The most dangerous messaging apps on Android
Messaging apps are becoming some of the most popular smartphone programs in the world, and that means more attempts to phish their users, Kaspersky finds.
⚠ Don’t get tricked by this crashtastic iPhone Wi-Fi hack! ⚠
📖 Read
via "Naked Security".
Learn how the trick works so that you can avoid it in case someone thinks it's a joke to catch you out.📖 Read
via "Naked Security".
Naked Security
Don’t get tricked by this crashtastic iPhone Wi-Fi hack!
Learn how the trick works so that you can avoid it in case someone thinks it’s a joke to catch you out.
❌ Critical RCE Vulnerability in ForgeRock OpenAM Under Active Attack ❌
📖 Read
via "Threat Post".
The attacks are enabled by an unpatched security vulnerability in ForgeRock's Access Management, a popular platform that front-ends web apps and remote-access setups.📖 Read
via "Threat Post".
Threat Post
Critical RCE Vulnerability in ForgeRock OpenAM Under Active Attack
The attacks are enabled by a (fixed) vulnerability in ForgeRock's Access Management, a popular platform that front-ends web apps and remote-access setups.
‼ CVE-2021-32703 ‼
📖 Read
via "National Vulnerability Database".
Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20414 ‼
📖 Read
via "National Vulnerability Database".
IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number of interactions. IBM X-Force ID: 196216.📖 Read
via "National Vulnerability Database".