‼ CVE-2021-41110 ‼
📖 Read
via "National Vulnerability Database".
cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41459 ‼
📖 Read
via "National Vulnerability Database".
There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a denial of service vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41456 ‼
📖 Read
via "National Vulnerability Database".
There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35297 ‼
📖 Read
via "National Vulnerability Database".
Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code.📖 Read
via "National Vulnerability Database".
🦿 Google stakes new Secure Open Source rewards program for developers with $1M seed money 🦿
📖 Read
via "Tech Republic".
The SOS program, run by the Linux Foundation, will reward developers with potentially more than $10,000 for enhancing the security of critical open source software.📖 Read
via "Tech Republic".
TechRepublic
Google stakes new Secure Open Source rewards program for developers with $1M seed money
The SOS program, run by the Linux Foundation, will reward developers with potentially more than $10,000 for enhancing the security of critical open source software.
♟️ FCC Proposal Targets SIM Swapping, Port-Out Fraud ♟️
📖 Read
via "Krebs on Security".
The U.S. Federal Communications Commission (FCC) is asking for feedback on new proposed rules to crack down on SIM swapping and number port-out fraud, increasingly prevalent scams in which identity thieves hijack a target's mobile phone number and use that to wrest control over the victim's online identity.📖 Read
via "Krebs on Security".
Krebs on Security
FCC Proposal Targets SIM Swapping, Port-Out Fraud
The U.S. Federal Communications Commission (FCC) is asking for feedback on new proposed rules to crack down on SIM swapping and number port-out fraud, increasingly prevalent scams in which identity thieves hijack a target's mobile phone number and use that…
🗓️ Prototype pollution vulnerabilities rife among high-traffic websites, study finds 🗓️
📖 Read
via "The Daily Swig".
Technique is exploitable at scale because it’s so overlooked, speculate researchers📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Prototype pollution vulnerabilities rife among high-traffic websites, study finds
Technique is exploitable at scale because it’s so overlooked, speculate researchers
🕴 CISA and Girls Who Code Partner to Create Career Pathways for Young Women 🕴
📖 Read
via "Dark Reading".
Through this partnership, CISA and Girls Who Code will establish collaborative opportunities to provide awareness, training, and pathways into cybersecurity careers for girls, women, and those who identify as nonbinary.📖 Read
via "Dark Reading".
Dark Reading
CISA and Girls Who Code Partner to Create Career Pathways for Young Women
Through this partnership, CISA and Girls Who Code will establish collaborative opportunities to provide awareness, training, and pathways into cybersecurity careers for girls, women, and those who identify as nonbinary.
❌ Flubot Malware Targets Androids With Fake Security Updates ❌
📖 Read
via "Threat Post".
The banking trojan keeps switching up its lies, trying to fool Android users into clicking on a fake Flubot-deleting app or supposedly uploaded photos of recipients.📖 Read
via "Threat Post".
Threat Post
Flubot Malware Targets Androids With Fake Security Updates
The banking trojan keeps switching up its lies, trying to fool Android users into clicking on a fake Flubot-deleting app or supposedly uploaded photos of recipients.
⚠ Gift card fraud – four suspects hit with money laundering charges ⚠
📖 Read
via "Naked Security".
Gift card fraud may sound like small beer against ransomware - but it's personal, it hurts, and it's still a multi-million dollar problem.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
⚠ How to steal money via Apple Pay using the “Express Transit” feature ⚠
📖 Read
via "Naked Security".
Could a rogue vendor with a dodgy payment terminal rip you off via Apple Pay? Maybe. Here's what to do about it.📖 Read
via "Naked Security".
Naked Security
How to steal money via Apple Pay using the “Express Transit” feature
Could a rogue vendor with a dodgy payment terminal rip you off via Apple Pay? Maybe. Here’s what to do about it.
⚠ S3 Ep52: Let’s Encrypt, Outlook leak, and VMware exploit [Podcast] ⚠
📖 Read
via "Naked Security".
Latest episode - listen now!📖 Read
via "Naked Security".
Naked Security
S3 Ep52: Let’s Encrypt, Outlook leak, and VMware exploit [Podcast]
Latest episode – listen now!
🛠 Falco 0.30.0 🛠
📖 Read
via "Packet Storm Security".
Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco will notify you when these rules are violated. You can think about falco as a mix between snort, ossec and strace.📖 Read
via "Packet Storm Security".
packetstorm.news
Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers
🛠 SQLMAP - Automatic SQL Injection Tool 1.5.10 🛠
📖 Read
via "Packet Storm Security".
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.📖 Read
via "Packet Storm Security".
packetstorm.news
Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers
‼ CVE-2021-29108 ‼
📖 Read
via "National Vulnerability Database".
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker to impersonate another account.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29110 ‼
📖 Read
via "National Vulnerability Database".
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40960 ‼
📖 Read
via "National Vulnerability Database".
Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41647 ‼
📖 Read
via "National Vulnerability Database".
An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41649 ‼
📖 Read
via "National Vulnerability Database".
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41648 ‼
📖 Read
via "National Vulnerability Database".
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3825 ‼
📖 Read
via "National Vulnerability Database".
On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.📖 Read
via "National Vulnerability Database".