❌ Malware Makers Using ‘Exotic’ Programming Languages ❌
📖 Read
via "Threat Post".
Sprechen Sie Rust? Polyglot malware authors are increasingly using obscure programming languages to evade detection.📖 Read
via "Threat Post".
Threat Post
Malware Makers Using ‘Exotic’ Programming Languages
Sprechen Sie Rust? Polyglot malware authors are increasingly using obscure programming languages to evade detection.
‼ CVE-2021-33629 ‼
📖 Read
via "National Vulnerability Database".
isula-build before 0.9.5-8 can cause a program crash, when building container images, some functions for processing external data do not remove spaces when processing data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37534 ‼
📖 Read
via "National Vulnerability Database".
app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.📖 Read
via "National Vulnerability Database".
🦿 Deepfakes: Microsoft and others in Big Tech are working to bring authenticity to videos, photos 🦿
📖 Read
via "Tech Republic".
If you want people to trust the photos and videos your business puts out, it might be time to start learning how to prove they haven't been tampered with.📖 Read
via "Tech Republic".
‼ CVE-2021-32790 ‼
📖 Read
via "National Vulnerability Database".
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32791 ‼
📖 Read
via "National Vulnerability Database".
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32789 ‼
📖 Read
via "National Vulnerability Database".
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25802 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25803 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32631 ‼
📖 Read
via "National Vulnerability Database".
Common is a package of common modules that can be accessed by NIMBLE services. Common before commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 did not properly verify the signature of JSON Web Tokens. This allows someone to forge a valid JWT. Being able to forge JWTs may lead to authentication bypasses. Commit number 3b96cb0293d3443b870351945f41d7d55cb34b53 contains a patch for the issue. As a workaround, one may use the parseClaimsJws method to correctly verify the signature of a JWT.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31292 ‼
📖 Read
via "National Vulnerability Database".
An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of service (DOS) via crafted metadata.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25804 ‼
📖 Read
via "National Vulnerability Database".
A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25801 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32792 ‼
📖 Read
via "National Vulnerability Database".
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31291 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability in jp2image.cpp of Exiv2 0.27.3 allows attackers to cause a denial of service (DOS) via crafted metadata.📖 Read
via "National Vulnerability Database".
🔏 Ransomware Prevention Site Saves Users $1 Billion 🔏
📖 Read
via "".
Five years after its inception, No More Ransom, the collaborative effort formed to combat ransomware attackers, has logged some impressive numbers.📖 Read
via "".
Digital Guardian
Ransomware Prevention Site Saves Users $1 Billion
Five years after its inception, No More Ransom, the collaborative effort formed to combat ransomware attackers, has logged some impressive numbers.
❌ Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC ❌
📖 Read
via "Threat Post".
Microsoft releases mitigations for a Windows NT LAN Manager exploit that forces remote Windows systems to reveal password hashes that can be easily cracked.📖 Read
via "Threat Post".
Threat Post
Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC
Microsoft releases mitigations for a Windows NT LAN Manager exploit that forces remote Windows systems to reveal password hashes that can be easily cracked.
‼ CVE-2021-36563 ‼
📖 Read
via "National Vulnerability Database".
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts), the XSS payload will be triggered when the user accesses some specific sections of the application. In the same sense a very dangerous potential way would be when an attacker who has the monitor role (not administrator) manages to get a stored XSS to steal the secretAutomation (for the use of the API in administrator mode) and thus be able to create another administrator user who has high privileges on the CheckMK monitoring web console. Another way is that persistent XSS allows an attacker to modify the displayed content or change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37394 ‼
📖 Read
via "National Vulnerability Database".
In RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to achieve admin user registration.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37392 ‼
📖 Read
via "National Vulnerability Database".
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32794 ‼
📖 Read
via "National Vulnerability Database".
ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due to a bug in ASF code `POST /Api/ASF` ASF API endpoint responsible for updating global ASF config incorrectly removed `IPCPassword` from the resulting config when the caller did not specify it explicitly. Due to the above, it was possible for the user to accidentally remove `IPCPassword` security measure from his IPC interface when updating global ASF config, which exists as part of global config update functionality in ASF-ui. Removal of `IPCPassword` possesses a security risk, as unauthorized users may in result access the IPC interface after such modification. The issue is patched in ASF V5.1.2.4 and future versions. We recommend to manually verify that `IPCPassword` is specified after update, and if not, set it accordingly. In default settings, ASF is configured to allow IPC access from `localhost` only and should not affect majority of users.📖 Read
via "National Vulnerability Database".