‼ CVE-2021-41124 ‼
📖 Read
via "National Vulnerability Database".
Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for Splash authentication will have any non-Splash request expose your credentials to the request target. This includes `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`. Upgrade to scrapy-splash 0.8.0 and use the new `SPLASH_USER` and `SPLASH_PASS` settings instead to set your Splash authentication credentials safely. If you cannot upgrade, set your Splash request credentials on a per-request basis, [using the `splash_headers` request parameter](https://github.com/scrapy-plugins/scrapy-splash/tree/0.8.x#http-basic-auth), instead of defining them globally using the [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth). Alternatively, make sure all your requests go through Splash. That includes disabling the [robots.txt middleware](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#topics-dlmw-robots).📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3319 ‼
📖 Read
via "National Vulnerability Database".
DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions >= > v2.4.0 contain NULL Pointer Dereference (CWE-476), Attempt to Access Child of a Non-structure Pointer (CWE-588). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-94jg-2p6q-5364📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3581 ‼
📖 Read
via "National Vulnerability Database".
Buffer Access with Incorrect Length Value in zephyr. Zephyr versions >= >=2.5.0 contain Buffer Access with Incorrect Length Value (CWE-805). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8q65-5gqf-fmw5📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3436 ‼
📖 Read
via "National Vulnerability Database".
BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known. Zephyr versions >= 1.14.2, >= 2.4.0, >= 2.5.0 contain Use of Multiple Resources with Duplicate Identifier (CWE-694). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-j76f-35mc-4h63📖 Read
via "National Vulnerability Database".
🕴 Google to Enable Two-Factor Authentication for 150M More Users 🕴
📖 Read
via "Dark Reading".
The company also provided guidance on how to protect information stored in inactive accounts.📖 Read
via "Dark Reading".
Dark Reading
Google to Enable Two-Factor Authentication for 150M More Users
The company also provided guidance on how to protect information stored in inactive accounts.
🕴 Mandiant Tackles Ransomware and Breaches With New Tools 🕴
📖 Read
via "Dark Reading".
Mandiant's new software-as-a-service offerings tap into the company's extensive threat intelligence capabilities to help cybersecurity teams detect and respond to ransomware attacks and data breaches.📖 Read
via "Dark Reading".
Dark Reading
Mandiant Tackles Ransomware and Breaches With New Tools
Mandiant's new software-as-a-service offerings tap into the company's extensive threat intelligence capabilities to help cybersecurity teams detect and respond to ransomware attacks and data breaches.
🕴 Misconfigured Apache Airflow Platforms Threaten Organizations 🕴
📖 Read
via "Dark Reading".
Security researchers found thousands of credentials for popular cloud-hosted services exposed on insecure instances of the popular workflow management technology.📖 Read
via "Dark Reading".
Dark Reading
Misconfigured Apache Airflow Platforms Threaten Organizations
Security researchers found thousands of credentials for popular cloud-hosted services exposed on insecure instances of the popular workflow management technology.
🕴 Mandia Alerted NSA on FireEye's SolarWinds Breach 🕴
📖 Read
via "Dark Reading".
"National security" concerns led former CEO Kevin Mandia to call the NSA when FireEye discovered its breach in late 2020.📖 Read
via "Dark Reading".
Dark Reading
Mandia Alerted NSA on FireEye's SolarWinds Breach
"National security" concerns led former CEO Kevin Mandia to call the NSA when FireEye discovered its breach in late 2020.
‼ CVE-2021-31987 ‼
📖 Read
via "National Vulnerability Database".
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33849 ‼
📖 Read
via "National Vulnerability Database".
A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41122 ‼
📖 Read
via "National Vulnerability Database".
Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21506 ‼
📖 Read
via "National Vulnerability Database".
waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21503 ‼
📖 Read
via "National Vulnerability Database".
waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21504 ‼
📖 Read
via "National Vulnerability Database".
waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31986 ‼
📖 Read
via "National Vulnerability Database".
User controlled parameters related to SMTP notifications are not correctly validated. This can lead to a buffer overflow resulting in crashes and data leakage.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21505 ‼
📖 Read
via "National Vulnerability Database".
waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31988 ‼
📖 Read
via "National Vulnerability Database".
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed (CRLF) control characters and include arbitrary SMTP headers in the generated test email.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3848 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a denial-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36170 ‼
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33602 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15941 ‼
📖 Read
via "National Vulnerability Database".
A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory traversal character sequences to add/delete the files of the server via the name parameter of Deployment Packages.📖 Read
via "National Vulnerability Database".