βΌ CVE-2021-33605 βΌ
π Read
via "National Vulnerability Database".
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled Checkbox inside enabled CheckboxGroup component via unspecified vectors.π Read
via "National Vulnerability Database".
βΌ CVE-2021-33882 βΌ
π Read
via "National Vulnerability Database".
A Missing Authentication for Critical Function vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to reconfigure the device from an unknown source because of lack of authentication on proprietary networking commands.π Read
via "National Vulnerability Database".
βΌ CVE-2021-33885 βΌ
π Read
via "National Vulnerability Database".
An Insufficient Verification of Data Authenticity vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to send the device malicious data that will be used in place of the correct data. This results in full system command access and execution because of the lack of cryptographic signatures on critical data sets.π Read
via "National Vulnerability Database".
βΌ CVE-2021-33883 βΌ
π Read
via "National Vulnerability Database".
A Cleartext Transmission of Sensitive Information vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote attacker to obtain sensitive information by snooping on the network traffic. The exposed data includes critical values for a pump's internal configuration.π Read
via "National Vulnerability Database".
βΌ CVE-2021-33886 βΌ
π Read
via "National Vulnerability Database".
An improper sanitization of input vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows a remote unauthenticated attacker to gain user-level command-line access by passing a raw external string straight through to printf statements. The attacker is required to be on the same network as the device.π Read
via "National Vulnerability Database".
π I2P 1.5.0 π
π Read
via "Packet Storm Security".
I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties. This is the source code release version.π Read
via "Packet Storm Security".
Packetstormsecurity
I2P 1.5.0 β Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
β US Media, Retailers Targeted by New SparklingGoblin APT β
π Read
via "Threat Post".
The new APT uses an undocumented backdoor to infiltrate the education, retail and government sectors.π Read
via "Threat Post".
Threat Post
US Media, Retailers Targeted by New SparklingGoblin APT
The new APT uses an undocumented backdoor to infiltrate the education, retail and government sectors.
βΌ CVE-2018-10790 βΌ
π Read
via "National Vulnerability Database".
The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory allocation failure, as demonstrated by mp2aac.π Read
via "National Vulnerability Database".
β Win10 Admin Rights Tossed Off by Yet Another Plug-In β
π Read
via "Threat Post".
Then again, you donβt even need the actual device β in this case, a SteelSeries peripheral β since emulation works just fine to launch with full SYSTEM rights.π Read
via "Threat Post".
Threat Post
Win10 Admin Rights Tossed Off by Yet Another Plug-In
Then again, you donβt even need the actual device β in this case, a SteelSeries peripheral β since emulation works just fine to launch with full SYSTEM rights.
π OnePercent Ransomware Group Has Hit US Companies Since November π
π Read
via "".
The group, like other malicious campaigns of late, has been using Cobalt Strike to carry out ransomware attacks against companies.π Read
via "".
Digital Guardian
OnePercent Ransomware Group Has Hit US Companies Since November
The group, like other malicious campaigns of late, has been using Cobalt Strike to carry out ransomware attacks against companies.
π¦Ώ Kanye's upcoming album is a scam magnet, Kaspersky finds π¦Ώ
π Read
via "Tech Republic".
"Donda" will be out Aug. 26, and scammers are taking advantage of fan anticipation by seeding the internet with malicious fake downloads.π Read
via "Tech Republic".
TechRepublic
Kanye's upcoming album is a scam magnet, Kaspersky finds
"Donda" will be out Aug. 26, and scammers are taking advantage of fan anticipation by seeding the internet with malicious fake downloads.
βΌ CVE-2021-21869 βΌ
π Read
via "National Vulnerability Database".
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2021-22244 βΌ
π Read
via "National Vulnerability Database".
Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulnerability dataπ Read
via "National Vulnerability Database".
βΌ CVE-2021-22256 βΌ
π Read
via "National Vulnerability Database".
Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track their statusπ Read
via "National Vulnerability Database".
βΌ CVE-2021-33015 βΌ
π Read
via "National Vulnerability Database".
Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. This could lead to an out-of-bounds write via an uninitialized pointer. An attacker could leverage this vulnerability to execute code in the context of the current process.π Read
via "National Vulnerability Database".
βΌ CVE-2021-22245 βΌ
π Read
via "National Vulnerability Database".
Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossible to viewπ Read
via "National Vulnerability Database".
βΌ CVE-2021-22237 βΌ
π Read
via "National Vulnerability Database".
Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2π Read
via "National Vulnerability Database".
βΌ CVE-2021-21835 βΌ
π Read
via "National Vulnerability Database".
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input when decoding the atom associated with the Γ’β¬ΕcsgpΓ’β¬οΏ½ FOURCC can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2021-21848 βΌ
π Read
via "National Vulnerability Database".
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The library will actually reuse the parser for atoms with the Γ’β¬ΕstszΓ’β¬οΏ½ FOURCC code when parsing atoms that use the Γ’β¬Εstz2Γ’β¬οΏ½ FOURCC code and can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.π Read
via "National Vulnerability Database".
βΌ CVE-2021-22242 βΌ
π Read
via "National Vulnerability Database".
Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdownπ Read
via "National Vulnerability Database".
βΌ CVE-2021-22243 βΌ
π Read
via "National Vulnerability Database".
Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another email address to gain access into a group.π Read
via "National Vulnerability Database".