‼ CVE-2021-30845 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6. A local user may be able to read kernel memory.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30835 ‼
📖 Read
via "National Vulnerability Database".
This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina, iTunes 12.12 for Windows, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing a maliciously crafted image may lead to arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37136 ‼
📖 Read
via "National Vulnerability Database".
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30850 ‼
📖 Read
via "National Vulnerability Database".
An access issue was addressed with improved access restrictions. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6, tvOS 15. A user may gain access to protected parts of the file system.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39355 ‼
📖 Read
via "National Vulnerability Database".
The Indeed Job Importer WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/indeed-job-importer/trunk/indeed-job-importer.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.5. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30358 ‼
📖 Read
via "National Vulnerability Database".
Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the Mobile Access Portal Agent.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30828 ‼
📖 Read
via "National Vulnerability Database".
This issue was addressed with improved checks. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local user may be able to read arbitrary files as root.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37137 ‼
📖 Read
via "National Vulnerability Database".
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39329 ‼
📖 Read
via "National Vulnerability Database".
The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/includes/admin/class-metabox.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.0.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3746 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30843 ‼
📖 Read
via "National Vulnerability Database".
This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing a maliciously crafted dfont file may lead to arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39343 ‼
📖 Read
via "National Vulnerability Database".
The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30819 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 15 and iPadOS 15. Processing a maliciously crafted USD file may disclose memory contents.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30825 ‼
📖 Read
via "National Vulnerability Database".
This issue was addressed with improved checks. This issue is fixed in iOS 15 and iPadOS 15. A local attacker may be able to cause unexpected application termination or arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30832 ‼
📖 Read
via "National Vulnerability Database".
A memory corruption issue was addressed with improved state management. This issue is fixed in Security Update 2021-005 Catalina, macOS Big Sur 11.6. A local attacker may be able to elevate their privileges.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30815 ‼
📖 Read
via "National Vulnerability Database".
A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. A local attacker may be able to view contacts from the lock screen.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-30841 ‼
📖 Read
via "National Vulnerability Database".
This issue was addressed with improved checks. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina, tvOS 15, iOS 15 and iPadOS 15, watchOS 8. Processing a maliciously crafted dfont file may lead to arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2011-1497 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.📖 Read
via "National Vulnerability Database".
🕴 Winners Announced for 2021 Infosec Inspire Security Awareness Awards 🕴
📖 Read
via "Dark Reading".
Institute of International Education and Inflection Point Systems recognized for their advanced security awareness and training programs.📖 Read
via "Dark Reading".
Dark Reading
Winners Announced for 2021 Infosec Inspire Security Awareness Awards
Institute of International Education and Inflection Point Systems recognized for their advanced security awareness and training programs.
❌ Lyceum APT Returns, This Time Targeting Tunisian Firms ❌
📖 Read
via "Threat Post".
The APT, which targets Middle-Eastern energy firms & telecoms, has been relatively quiet since its exposure but not entirely silent. It's kept up attacks through 2021 and is working on retooling its arsenal yet again. 📖 Read
via "Threat Post".
Threat Post
Lyceum APT Returns, This Time Targeting Tunisian Firms
The APT, which targets Middle Eastern energy firms & telecoms, has been relatively quiet since its exposure but not entirely silent. It's kept up attacks through 2021 and is working on retooling its arsenal yet again.
‼ CVE-2021-38911 ‼
📖 Read
via "National Vulnerability Database".
IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID: 209940.📖 Read
via "National Vulnerability Database".