π¦Ώ Security alert: The threat is coming from inside your Docker container images π¦Ώ
π Read
via "Tech Republic".
Five malicious Docker container images were recently detected on Docker Hub, totaling more than 120,000 pulls.π Read
via "Tech Republic".
TechRepublic
Security alert: The threat is coming from inside your Docker container images
Five malicious Docker container images were recently detected on Docker Hub, totaling more than 120,000 pulls.
β Parallels Offers βInconvenientβ Fix for High-Severity Bug β
π Read
via "Threat Post".
Firm offers guidance on how to mitigate a five-months-old privilege escalation bug impacting Parallels Desktop 16 for Mac and all previous versions.π Read
via "Threat Post".
Threat Post
Parallels Offers βInconvenientβ Fix for High-Severity Bug
Firm offers guidance on how to mitigate a five-months-old privilege escalation bug impacting Parallels Desktop 16 for Mac and all previous versions.
βΌ CVE-2020-18106 βΌ
π Read
via "National Vulnerability Database".
The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.π Read
via "National Vulnerability Database".
βΌ CVE-2020-18114 βΌ
π Read
via "National Vulnerability Database".
An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.π Read
via "National Vulnerability Database".
βΌ CVE-2020-18116 βΌ
π Read
via "National Vulnerability Database".
A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.π Read
via "National Vulnerability Database".
βΌ CVE-2021-39174 βΌ
π Read
via "National Vulnerability Database".
Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can leak the value of any configuration entry of the dotenv file, e.g. the application secret (`APP_KEY`) and various passwords (email, database, etc). This issue was addressed in version 2.5.1 by improving `UpdateConfigCommandHandler` and preventing the use of nested variables in the resulting dotenv configuration file. As a workaround, only allow trusted source IP addresses to access to the administration dashboard.π Read
via "National Vulnerability Database".
β T-Mobileβs Security Is βAwful,β Says Purported Thief β
π Read
via "Threat Post".
John Binns, claiming to be behind the massive T-Mobile theft of >50m customer records, dissed the security measures of the US's No. 2 wireless biggest carrier. T-Mobile is "humbled," it said, announcing new partnerships with security heavyweights on Friday.π Read
via "Threat Post".
Threat Post
T-Mobileβs Security Is βAwful,β Says Purported Thief
John Binns, claiming to be behind the massive T-Mobile theft of >50M customer records, dissed the security measures of the US's No. 2 wireless biggest carrier. T-Mobile is "humbled," it said.
βΌ CVE-2021-40176 βΌ
π Read
via "National Vulnerability Database".
Zoho ManageEngine Log360 before Build 5225 allows stored XSS.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40172 βΌ
π Read
via "National Vulnerability Database".
Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40175 βΌ
π Read
via "National Vulnerability Database".
Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40177 βΌ
π Read
via "National Vulnerability Database".
Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40173 βΌ
π Read
via "National Vulnerability Database".
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40178 βΌ
π Read
via "National Vulnerability Database".
Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings.π Read
via "National Vulnerability Database".
βΌ CVE-2021-40174 βΌ
π Read
via "National Vulnerability Database".
Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.π Read
via "National Vulnerability Database".
βΌ CVE-2021-37749 βΌ
π Read
via "National Vulnerability Database".
MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) parameter to the GetMap method.π Read
via "National Vulnerability Database".
βΌ CVE-2021-26084 βΌ
π Read
via "National Vulnerability Database".
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. The vulnerable endpoints can be accessed by a non-administrator user or unauthenticated user if Γ’β¬ΛAllow people to sign up to create their accountΓ’β¬β’ is enabled. To check whether this is enabled go to COG > User Management > User Signup Options. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.π Read
via "National Vulnerability Database".
βΌ CVE-2021-39117 βΌ
π Read
via "National Vulnerability Database".
The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability via the name of a custom field.π Read
via "National Vulnerability Database".
βΌ CVE-2021-39272 βΌ
π Read
via "National Vulnerability Database".
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH.π Read
via "National Vulnerability Database".
βΌ CVE-2021-39113 βΌ
π Read
via "National Vulnerability Database".
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after losing permissions, via a Broken Access Control vulnerability in the allowlist feature. The affected versions are before version 8.13.9, and from version 8.14.0 before 8.18.0.π Read
via "National Vulnerability Database".
βΌ CVE-2021-39111 βΌ
π Read
via "National Vulnerability Database".
The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before 8.18.2 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the handling of supplied content such as from a PDF when pasted into a field such as the description field.π Read
via "National Vulnerability Database".
βΌ CVE-2021-36359 βΌ
π Read
via "National Vulnerability Database".
OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platypus\paraparser.py (reached via bscw.cgi op=_editfolder.EditFolder) calls eval on attacker-supplied Python code. This is fixed in 5.0.12, 5.1.10, 5.2.4, 7.3.3, and 7.4.3.π Read
via "National Vulnerability Database".