‼ CVE-2021-3848 ‼
📖 Read
via "National Vulnerability Database".
An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a denial-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36170 ‼
📖 Read
via "National Vulnerability Database".
An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authenticated attacker to read the FortiCloud credentials which were used to activate the trial license in cleartext.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-33602 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZW decompression method), and this can crash the scanning engine. The vulnerability can be exploited remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-15941 ‼
📖 Read
via "National Vulnerability Database".
A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to inject directory traversal character sequences to add/delete the files of the server via the name parameter of Deployment Packages.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24021 ‼
📖 Read
via "National Vulnerability Database".
An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer, should the attacker be able to obtain that POST request, via other, hypothetical attacks.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24019 ‼
📖 Read
via "National Vulnerability Database".
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks)📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36178 ‼
📖 Read
via "National Vulnerability Database".
A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices credential information via configuration page lookup.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-36175 ‼
📖 Read
via "National Vulnerability Database".
An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device.📖 Read
via "National Vulnerability Database".
🗓️ Firefox 93 lands with HTTP download blocking, new user privacy features 🗓️
📖 Read
via "The Daily Swig".
Roadblocks erected against untrusted content and unwanted ads📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Firefox 93 lands with HTTP download blocking, new user privacy features
Roadblocks erected against untrusted content and unwanted ads
🗓️ Multiple XSS vulnerabilities in child monitoring app Canopy ‘could risk location leak’ 🗓️
📖 Read
via "The Daily Swig".
Pair of unpatched security bugs are ‘just the tip of the iceberg’📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Multiple XSS vulnerabilities in child monitoring app Canopy ‘could risk location leak’
Pair of unpatched security bugs are ‘just the tip of the iceberg’
🕴 A Culture of Unity Is Key to Solving the Cyber Challenge 🕴
📖 Read
via "Dark Reading".
Lack of unity in vendor solutions and in security teams' culture are detrimental to a successful and productive security strategy.📖 Read
via "Dark Reading".
Dark Reading
A Culture of Unity Is Key to Solving the Cyber Challenge
Lack of unity in vendor solutions and in security teams' culture are detrimental to a successful and productive security strategy.
‼ CVE-2020-19003 ‼
📖 Read
via "National Vulnerability Database".
An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.📖 Read
via "National Vulnerability Database".
🦿 How a phishing attack thwarted MFA to steal money from Coinbase customers 🦿
📖 Read
via "Tech Republic".
A flaw in Coinbase's setup of SMS-based MFA allowed attackers to compromise a large number of accounts.📖 Read
via "Tech Republic".
TechRepublic
How a phishing attack thwarted MFA to steal money from Coinbase customers
A flaw in Coinbase's setup of SMS-based MFA allowed attackers to compromise a large number of accounts.
🕴 Optiv Rebrands as Cyber Advisory & Solutions Leader 🕴
📖 Read
via "Dark Reading".
Optiv announced it will create a new market category to protect business value and accelerate performance.📖 Read
via "Dark Reading".
Dark Reading
Optiv Rebrands as Cyber Advisory & Solutions Leader
Optiv announced it will create a new market category to protect business value and accelerate performance.
❌ Twitch Gets Gutted: All Source Code Leaked ❌
📖 Read
via "Threat Post".
An anonymous user posted a link to a 125GB torrent to 4chan yesterday, containing all of Twitch's source code, comments going back to its inception and more.📖 Read
via "Threat Post".
Threat Post
Twitch Gets Gutted: All Source Code Leaked
An anonymous user posted a link to a 125GB torrent to 4chan yesterday, containing all of Twitch's source code, comments going back to its inception and more.
🗓️ OPPA: Ohio could become the third US state to enact a new consumer privacy law in 2021 🗓️
📖 Read
via "The Daily Swig".
Ohio Personal Privacy Act will grant Ohioans an expansive set of new rights, writes US attorney David Oberly📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
OPPA: Ohio could become the third US state to enact a new consumer privacy law in 2021
Ohio Personal Privacy Act will grant Ohioans an expansive set of new rights, writes US attorney David Oberly
‼ CVE-2021-0635 ‼
📖 Read
via "National Vulnerability Database".
When extracting the incorrectly formatted flv file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion:Android-10Android ID: A-189402477📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0693 ‼
📖 Read
via "National Vulnerability Database".
In openFile of HeapDumpProvider.java, there is a possible way to retrieve generated heap dumps from debuggable apps due to an unprotected provider. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-184046948📖 Read
via "National Vulnerability Database".
‼ CVE-2021-28702 ‼
📖 Read
via "National Vulnerability Database".
PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0682 ‼
📖 Read
via "National Vulnerability Database".
In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-159624555📖 Read
via "National Vulnerability Database".
‼ CVE-2021-0695 ‼
📖 Read
via "National Vulnerability Database".
In get_sock_stat of xt_qtaguid.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-184018316References: Upstream kernel📖 Read
via "National Vulnerability Database".