‼ CVE-2021-38554 ‼
📖 Read
via "National Vulnerability Database".
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18759 ‼
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32069 ‼
📖 Read
via "National Vulnerability Database".
The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18757 ‼
📖 Read
via "National Vulnerability Database".
An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36790 ‼
📖 Read
via "National Vulnerability Database".
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36788 ‼
📖 Read
via "National Vulnerability Database".
The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36791 ‼
📖 Read
via "National Vulnerability Database".
The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37586 ‼
📖 Read
via "National Vulnerability Database".
The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to replay a previously recorded conversation of another tenant due to insufficient validation.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18753 ‼
📖 Read
via "National Vulnerability Database".
An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escalate privileges via a crafted packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32067 ‼
📖 Read
via "National Vulnerability Database".
The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization.📖 Read
via "National Vulnerability Database".
❌ Exchange Servers Under Active Attack via ProxyShell Bugs ❌
📖 Read
via "Threat Post".
There’s an entirely new attack surface in Exchange, a researcher revealed at Black Hat, and threat actors are now exploiting servers vulnerable to the RCE bugs.📖 Read
via "Threat Post".
Threat Post
Exchange Servers Under Active Attack via ProxyShell Bugs
There’s an entirely new attack surface in Exchange, a researcher revealed at Black Hat, and threat actors are now exploiting servers vulnerable to the RCE bugs.
‼ CVE-2021-21829 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-21830 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. A specially crafted XMI file can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.📖 Read
via "National Vulnerability Database".
❌ SolarWinds 2.0 Could Ignite Financial Crisis – Podcast ❌
📖 Read
via "Threat Post".
That’s what NY State suggests could happen, given the utter lack of cybersec protection at many private equity & hedge fund firms. Can AI help avert it?📖 Read
via "Threat Post".
Threat Post
SolarWinds 2.0 Could Ignite Financial Crisis – Podcast
That’s what NY State suggests could happen, given the utter lack of cybersec protection at many private equity & hedge fund firms. Can AI help avert it?
❌ Cyberattackers Embrace CAPTCHAs to Hide Phishing, Malware ❌
📖 Read
via "Threat Post".
CAPTCHA-protected malicious URLs are snowballing lately, researchers said.📖 Read
via "Threat Post".
Threat Post
Cyberattackers Embrace CAPTCHAs to Hide Phishing, Malware
CAPTCHA-protected malicious URLs are snowballing lately, researchers said.
❌ Amazon’s Plan to Track Worker Keystrokes: A Sign of Controls to Come? ❌
📖 Read
via "Threat Post".
Data theft, insider threats and imposters accessing sensitive customer data have apparently gotten so bad inside Amazon, the company is considering rolling out keyboard-stroke monitoring for its customer-service reps. A confidential memo from inside Amazon explained that customer service credential abuse and data theft was on the rise, according to Motherboard which reviewed the document. […]📖 Read
via "Threat Post".
Threat Post
Amazon’s Plan to Track Worker Keystrokes: A Sign of Controls to Come?
Amazon is considering rolling out keyboard-stroke monitoring for its customer-service reps.
‼ CVE-2020-21066 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in Bento4 v1.5.1.0. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a denial of service (program crash), as demonstrated by mp42aac.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21064 ‼
📖 Read
via "National Vulnerability Database".
A buffer-overflow vulnerability in the AP4_RtpAtom::AP4_RtpAtom function in Ap4RtpAtom.cpp of Bento4 1.5.1.0 allows attackers to cause a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37705 ‼
📖 Read
via "National Vulnerability Database".
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38709 ‼
📖 Read
via "National Vulnerability Database".
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26086 ‼
📖 Read
via "National Vulnerability Database".
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/web.xml endpoint. The affected versions are before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1.📖 Read
via "National Vulnerability Database".