‼ CVE-2021-0293 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in Juniper Networks Junos OS caused by Missing Release of Memory after Effective Lifetime leads to a memory leak each time the CLI command 'show system connections extensive' is executed. The amount of memory leaked on each execution depends on the number of TCP connections from and to the system. Repeated execution will cause more memory to leak and eventually daemons that need to allocate additionally memory and ultimately the kernel to crash, which will result in traffic loss. Continued execution of this command will cause a sustained Denial of Service (DoS) condition. An administrator can use the following CLI command to monitor for increase in memory consumption of the netstat process, if it exists: user@junos> show system processes extensive | match "username|netstat" PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 21181 root 100 0 5458M 4913M CPU3 2 0:59 97.27% netstat The following log message might be observed if this issue happens: kernel: %KERN-3: pid 21181 (netstat), uid 0, was killed: out of swap space This issue affects Juniper Networks Junos OS 18.2 versions prior to 18.2R2-S8, 18.2R3-S7. 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S6, 18.4R3-S7; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S1; 19.4 versions prior to 19.4R1-S4, 19.4R2-S3, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2-S1, 20.2R3; 20.3 versions prior to 20.3R1-S1, 20.3R2; This issue does not affect Juniper Networks Junos OS versions prior to 18.2R1.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0287 ‼
📖 Read
via "National Vulnerability Database".
In a Segment Routing ISIS (SR-ISIS)/MPLS environment, on Juniper Networks Junos OS and Junos OS Evolved devices, configured with ISIS Flexible Algorithm for Segment Routing and sensor-based statistics, a flap of a ISIS link in the network, can lead to a routing process daemon (RPD) crash and restart, causing a Denial of Service (DoS). Continued link flaps will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 19.4 versions prior to 19.4R1-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S1, 20.1R3; 20.2 versions prior to 20.2R2-S2, 20.2R3; 20.3 versions prior to 20.3R2; Juniper Networks Junos OS Evolved: 20.3-EVO versions prior to 20.3R2-EVO; 20.4-EVO versions prior to 20.4R2-EVO. This issue does not affect: Juniper Networks Junos OS releases prior to 19.4R1. Juniper Networks Junos OS Evolved releases prior to 19.4R1-EVO.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36753 ‼
📖 Read
via "National Vulnerability Database".
sharkdp BAT before 0.18.2 executes less.exe from the current working directory.📖 Read
via "National Vulnerability Database".
🕴 Attackers Exploited 4 Zero-Day Flaws in Chrome, Safari & IE 🕴
📖 Read
via "Dark Reading".
At least two government-backed actors -- including one Russian group -- used the now-patched flaws in separate campaigns, Google says.📖 Read
via "Dark Reading".
Dark Reading
Attackers Exploited 4 Zero-Day Flaws in Chrome, Safari & IE
At least two government-backed actors -- including one Russian group -- used the now-patched flaws in separate campaigns, Google says.
‼ CVE-2020-23707 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23705 ‼
📖 Read
via "National Vulnerability Database".
A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36758 ‼
📖 Read
via "National Vulnerability Database".
1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.📖 Read
via "National Vulnerability Database".
❌ Microsoft: New Unpatched Bug in Windows Print Spooler ❌
📖 Read
via "Threat Post".
Another vulnerability separate from PrintNightmare allows for local elevation of privilege and system takeover.📖 Read
via "Threat Post".
Threat Post
Microsoft: New Unpatched Bug in Windows Print Spooler
Another vulnerability separate from PrintNightmare allows for local elevation of privilege and system takeover.
‼ CVE-2021-21802 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21818 ‼
📖 Read
via "National Vulnerability Database".
A hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to a denial of service. An attacker can send a sequence of requests to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21820 ‼
📖 Read
via "National Vulnerability Database".
A hard-coded password vulnerability exists in the Libcli Test Environment functionality of D-LINK DIR-3040 1.13B03. A specially crafted network request can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21801 ‼
📖 Read
via "National Vulnerability Database".
This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.📖 Read
via "National Vulnerability Database".
🕴 How to Attract More Computer Science Grads to the Cybersecurity Field 🕴
📖 Read
via "Dark Reading".
With 465,000 cybersecurity job openings in the United States, why is recruiting so difficult? A recent college graduate offers his take.📖 Read
via "Dark Reading".
Dark Reading
How to Attract More Computer Science Grads to the Cybersecurity Field
With 465,000 cybersecurity job openings in the United States, why is recruiting so difficult? A recent college graduate offers his take.
‼ CVE-2021-1422 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the device that results in a denial of service (DoS) condition. The vulnerability is due to a logic error in how the software cryptography module handles specific types of decryption errors. An attacker could exploit this vulnerability by sending malicious packets over an established IPsec connection. A successful exploit could cause the device to crash, forcing it to reload. Important: Successful exploitation of this vulnerability would not cause a compromise of any encrypted data. Note: This vulnerability affects only Cisco ASA Software Release 9.16.1 and Cisco FTD Software Release 7.0.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-28114 ‼
📖 Read
via "National Vulnerability Database".
Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.📖 Read
via "National Vulnerability Database".
🕴 4 Future Integrated Circuit Threats to Watch 🕴
📖 Read
via "Dark Reading".
Threats to the supply chains for ICs and other computer components are poised to wreak even more havoc on organizations.📖 Read
via "Dark Reading".
Dark Reading
4 Future Integrated Circuit Threats to Watch
Threats to the supply chains for ICs and other computer components are poised to wreak even more havoc on organizations.
🔏 Friday Five 7/16 🔏
📖 Read
via "".
iOS zero days, the state of U.S. chipmaking, and the disruption of a phishing ring - catch up on all of the week's infosec news with the Friday Five!📖 Read
via "".
Digital Guardian
Friday Five 7/16
iOS zero days, the state of U.S. chipmaking, and the disruption of a phishing ring - catch up on all of the week's infosec news with the Friday Five!
⚠ Want to earn $10 million? Snitch on a cybercrook! ⚠
📖 Read
via "Naked Security".
Will going after the big guns help to discourage and disrupt the rest of the cybercrime ecosystem? Have your say...📖 Read
via "Naked Security".
Naked Security
Want to earn $10 million? Snitch on a cybercrook!
Will going after the big guns help to discourage and disrupt the rest of the cybercrime ecosystem? Have your say…
❌ Windows 0-Days Used Against Dissidents in Israeli Broker’s Spyware ❌
📖 Read
via "Threat Post".
Candiru, aka Sourgum, allegedly sells the DevilsTongue surveillance malware to governments around the world.📖 Read
via "Threat Post".
Threat Post
Windows 0-Days Used Against Dissidents in Israeli Broker’s Spyware
Candiru, aka Sourgum, allegedly sells the DevilsTongue surveillance malware to governments around the world.
⚠ More PrintNightmare: “We TOLD you not to turn the Print Spooler back on!” ⚠
📖 Read
via "Naked Security".
The PrintNightmare continues. So does our advice, even though it stops your printer working.📖 Read
via "Naked Security".
Naked Security
More PrintNightmare: “We TOLD you not to turn the Print Spooler back on!”
The PrintNightmare continues. So does our advice, even though it stops your printer working.
‼ CVE-2021-3649 ‼
📖 Read
via "National Vulnerability Database".
chatwoot is vulnerable to Inefficient Regular Expression Complexity📖 Read
via "National Vulnerability Database".