‼ CVE-2021-3766 ‼
📖 Read
via "National Vulnerability Database".
objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')📖 Read
via "National Vulnerability Database".
‼ CVE-2021-25737 ‼
📖 Read
via "National Vulnerability Database".
A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36744 ‼
📖 Read
via "National Vulnerability Database".
Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit the system to escalate privileges and create a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3767 ‼
📖 Read
via "National Vulnerability Database".
bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')📖 Read
via "National Vulnerability Database".
❌ IoT Attacks Skyrocket, Doubling in 6 Months ❌
📖 Read
via "Threat Post".
The first half of 2021 saw 1.5 billion attacks on smart devices, with attackers looking to steal data, mine cryptocurrency or build botnets.📖 Read
via "Threat Post".
Threat Post
IoT Attacks Skyrocket, Doubling in 6 Months
The first half of 2021 saw 1.5 billion attacks on smart devices, with attackers looking to steal data, mine cryptocurrency or build botnets.
⚠ Poisoned proxy PACs! The NPM package with a network-wide security hole… ⚠
📖 Read
via "Naked Security".
3,000,000 downloads a week... if only they'd read the fastitidous manual!📖 Read
via "Naked Security".
Naked Security
Poisoned proxy PACs! The NPM package with a network-wide security hole…
3,000,000 downloads a week… if only they’d read the fastidious manual!
❌ Human Fraud: Detecting Them Before They Detect You ❌
📖 Read
via "Threat Post".
Tony Lauro, director of security technology and strategy at Akamai, discusses how to disrupt account takeovers in the exploitation phase of an attack.📖 Read
via "Threat Post".
Threat Post
Human Fraud: Detecting Them Before They Detect You
Tony Lauro, director of security technology and strategy at Akamai, discusses how to disrupt account takeovers in the exploitation phase of an attack.
‼ CVE-2021-36094 ‼
📖 Read
via "National Vulnerability Database".
It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36096 ‼
📖 Read
via "National Vulnerability Database".
Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36093 ‼
📖 Read
via "National Vulnerability Database".
It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36095 ‼
📖 Read
via "National Vulnerability Database".
Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40531 ‼
📖 Read
via "National Vulnerability Database".
Sketch before 75 mishandles external library feeds.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40532 ‼
📖 Read
via "National Vulnerability Database".
Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40540 ‼
📖 Read
via "National Vulnerability Database".
ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31611 ‼
📖 Read
via "National Vulnerability Database".
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure that is followed by a malformed LMP packet, allowing attackers in radio range to deadlock a device via a crafted LMP packet. The user needs to manually reboot the device to restore communication.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34144 ‼
📖 Read
via "National Vulnerability Database".
The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33483 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31609 ‼
📖 Read
via "National Vulnerability Database".
The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP packet greater than 17 bytes, allowing attackers in radio range to trigger a crash in WT32i via a crafted LMP packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31613 ‼
📖 Read
via "National Vulnerability Database".
The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers in radio range to immediately crash (and restart) a device via a crafted LMP packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34148 ‼
📖 Read
via "National Vulnerability Database".
The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the reception of LMP_max_slot with a greater ACL Length after completion of the LMP setup procedure, allowing attackers in radio range to trigger a denial of service (firmware crash) via a crafted LMP packet.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-34146 ‼
📖 Read
via "National Vulnerability Database".
The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and restart (crash) of the device by flooding it with LMP_AU_Rand packets after the paging procedure.📖 Read
via "National Vulnerability Database".