‼ CVE-2021-39258 ‼
📖 Read
via "National Vulnerability Database".
A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33289 ‼
📖 Read
via "National Vulnerability Database".
In Tuxera NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39257 ‼
📖 Read
via "National Vulnerability Database".
A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39262 ‼
📖 Read
via "National Vulnerability Database".
A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39259 ‼
📖 Read
via "National Vulnerability Database".
A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G < 2021.8.22.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39252 ‼
📖 Read
via "National Vulnerability Database".
A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33287 ‼
📖 Read
via "National Vulnerability Database".
Tuxera NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow can occur and allow for writing to arbitrary memory or denial of service of the application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33286 ‼
📖 Read
via "National Vulnerability Database".
In Tuxera NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and allow for code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35266 ‼
📖 Read
via "National Vulnerability Database".
In Tuxera NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur resulting in memory disclosure, denial of service and even code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-19131 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop".📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39261 ‼
📖 Read
via "National Vulnerability Database".
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-7832 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbitrary file via AddUploadFile, SetSelectItem, DoOpenFile function.(CVE-2020-7832)📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35268 ‼
📖 Read
via "National Vulnerability Database".
Tuxera NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow can occur allowing for code execution and escalation of privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39255 ‼
📖 Read
via "National Vulnerability Database".
A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.📖 Read
via "National Vulnerability Database".
❌ ProtonMail Forced to Log IP Address of French Activist ❌
📖 Read
via "Threat Post".
The privacy-touting, end-to-end encrypted email provider erased its site's “we don’t log your IP” boast after France sicced Swiss cops on it.📖 Read
via "Threat Post".
Threat Post
ProtonMail Forced to Log IP Address of French Activist
The privacy-touting, end-to-end encrypted email provider erased its site's “we don’t log your IP” boast after France sicced Swiss cops on it.
❌ Jenkins Hit as Atlassian Confluence Cyberattacks Widen ❌
📖 Read
via "Threat Post".
Patch now: The popular biz-collaboration platform is seeing mass scanning and exploitation just two weeks after a critical RCE bug was disclosed.📖 Read
via "Threat Post".
Threat Post
Jenkins Hit as Atlassian Confluence Cyberattacks Widen
Patch now: The popular biz-collaboration platform is seeing mass scanning and exploitation just two weeks after a critical RCE bug was disclosed.
🦿 How to control activity tracking by apps on your iPhone or iPad 🦿
📖 Read
via "Tech Republic".
You can tell iOS and iPadOS apps not to track your activity. Here's how.📖 Read
via "Tech Republic".
TechRepublic
How to control activity tracking by apps on your iPhone or iPad
You can tell iOS and iPadOS apps not to track your activity. Here's how.
‼ CVE-2021-40539 ‼
📖 Read
via "National Vulnerability Database".
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38123 ‼
📖 Read
via "National Vulnerability Database".
Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05, 2020.02, 2020.08, 2020.11, 2021.05. The vulnerability could allow redirect users to malicious websites after authentication.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39197 ‼
📖 Read
via "National Vulnerability Database".
better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks. As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent). Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3". There are no known workarounds to mitigate the risk of using older releases of better_errors.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38142 ‼
📖 Read
via "National Vulnerability Database".
Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).📖 Read
via "National Vulnerability Database".