‼ CVE-2021-40347 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39207 ‼
📖 Read
via "National Vulnerability Database".
parlai is a framework for training and evaluating AI models on a variety of openly available dialogue datasets. In affected versions the package is vulnerable to YAML deserialization attack caused by unsafe loading which leads to Arbitary code execution. This security bug is patched by avoiding unsafe loader users should update to version above v1.1.0. If upgrading is not possible then users can change the Loader used to SafeLoader as a workaround. See commit 507d066ef432ea27d3e201da08009872a2f37725 for details.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24040 ‼
📖 Read
via "National Vulnerability Database".
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-38555 ‼
📖 Read
via "National Vulnerability Database".
An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40146 ‼
📖 Read
via "National Vulnerability Database".
A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.📖 Read
via "National Vulnerability Database".
📢 The best remote access solutions 📢
📖 Read
via "ITPro".
We round up the top remote access software for mobile workers, including those with collaboration, screen-sharing and support tools📖 Read
via "ITPro".
IT PRO
The best remote access software | IT PRO
We round up the top remote access software for mobile workers, including those with collaboration, screen-sharing and support tools
📢 Ransomware hackers break off from Babuk to join a new group 📢
📖 Read
via "ITPro".
New research shines a light on the fallout between criminals in the wake of the Colonial Pipeline attack📖 Read
via "ITPro".
IT PRO
Ransomware hackers break off from Babuk to join a new group | IT PRO
New research shines a light on the fallout between criminals in the wake of the Colonial Pipeline attack
📢 DOJ extradites Ukrainian man who used a botnet to decrypt login credentials 📢
📖 Read
via "ITPro".
The 28-year-old allegedly sold passwords to other criminals on the dark web📖 Read
via "ITPro".
IT PRO
DOJ extradites Ukrainian man who used a botnet to decrypt login credentials | IT PRO
The 28-year-old allegedly sold passwords to other criminals on the dark web
📢 Dell launches new security services to tackle surging data demands 📢
📖 Read
via "ITPro".
These new products aim to mitigate against data protection anxieties and the rising threat of ransomware📖 Read
via "ITPro".
IT PRO
Dell launches new security services to tackle surging data demands | IT PRO
These new products aim to mitigate against data protection anxieties and the rising threat of ransomware
‼ CVE-2021-23440 ‼
📖 Read
via "National Vulnerability Database".
This affects the package set-value before 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-23435 ‼
📖 Read
via "National Vulnerability Database".
This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).📖 Read
via "National Vulnerability Database".
🗓️ Texas Republican Party website defaced in ‘Anonymous’ protest against abortion law 🗓️
📖 Read
via "The Daily Swig".
Hacktivists take aim at ‘Heartbeat Act’ with references to The Handmaid’s Tale and Rick-rolling meme📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Texas Republican Party website defaced in ‘Anonymous’ protest against abortion law
Hacktivists take aim at ‘Heartbeat Act’ with references to The Handmaid’s Tale and Rick-rolling meme
🦿 Phony vaccine card prices double following Biden mandate announcement 🦿
📖 Read
via "Tech Republic".
Dark Web prices for fake vaccination cards shot up from $100 to $200 almost immediately after the president announced new mandates, says Check Point Research.📖 Read
via "Tech Republic".
TechRepublic
Phony COVID-19 vaccine card prices double following Biden mandate announcement
Dark Web prices for fake COVID-19 vaccination cards shot up from $100 to $200 almost immediately after the U.S. president announced new mandates, says Check Point Research.
‼ CVE-2021-22526 ‼
📖 Read
via "National Vulnerability Database".
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32136 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27969 ‼
📖 Read
via "National Vulnerability Database".
Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22527 ‼
📖 Read
via "National Vulnerability Database".
Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22524 ‼
📖 Read
via "National Vulnerability Database".
Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4📖 Read
via "National Vulnerability Database".
‼ CVE-2021-22528 ‼
📖 Read
via "National Vulnerability Database".
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40214 ‼
📖 Read
via "National Vulnerability Database".
Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-27970 ‼
📖 Read
via "National Vulnerability Database".
Yandex Browser before 20.10.0 allows remote attackers to spoof the address bar📖 Read
via "National Vulnerability Database".