📢 Manufacturers forced to improve cyber security of wireless devices under new EU rule 📢
📖 Read
via "ITPro".
Businesses will have 30 months to comply with the new rules if they want to ship their products to the EU📖 Read
via "ITPro".
IT PRO
Manufacturers forced to improve cyber security of wireless devices under new EU rule | IT PRO
Businesses will have 30 months to comply with the new rules if they want to ship their products to the EU
📢 Apple's ad transparency policy has cost Facebook, YouTube, Snap almost $10 billion so far 📢
📖 Read
via "ITPro".
Estimate from the Financial Times says Facebook has been hit hardest by new rule requiring user consent📖 Read
via "ITPro".
IT PRO
Apple's ad transparency policy has cost Facebook, YouTube, Snap almost $10 billion so far | IT PRO
Estimate from the Financial Times says Facebook has been hit hardest by new rule requiring user consent
📢 Microsoft Exchange Servers are being used to distribute SquirrelWaffle malware 📢
📖 Read
via "ITPro".
Exploiting an unpatched Exchange Server vulnerability and a less-than-foolproof malicious URL strategy is leading to mounting infections in businesses📖 Read
via "ITPro".
ITPro
Microsoft Exchange Servers are being used to distribute Qakbot malware
Exploiting an unpatched Exchange Server vulnerability and a less-than-foolproof malicious URL strategy is leading to mounting infections in businesses
‼ CVE-2021-43267 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37982 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43264 ‼
📖 Read
via "National Vulnerability Database".
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37993 ‼
📖 Read
via "National Vulnerability Database".
Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43270 ‼
📖 Read
via "National Vulnerability Database".
Datalust Seq.App.HtmlEmail (aka Seq.App.EmailPlus) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 in some cases where encryption on port 465 was intended.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37991 ‼
📖 Read
via "National Vulnerability Database".
Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42697 ‼
📖 Read
via "National Vulnerability Database".
Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37990 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin data via a crafted app.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37996 ‼
📖 Read
via "National Vulnerability Database".
Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a malicious file.📖 Read
via "National Vulnerability Database".
‼ CVE-2019-13776 ‼
📖 Read
via "National Vulnerability Database".
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: some publications have used this number when they meant to use CVE-2019-13376.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-16048 ‼
📖 Read
via "National Vulnerability Database".
Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37983 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2018-6125 ‼
📖 Read
via "National Vulnerability Database".
Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37984 ‼
📖 Read
via "National Vulnerability Database".
Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37994 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2017-5123 ‼
📖 Read
via "National Vulnerability Database".
Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37989 ‼
📖 Read
via "National Vulnerability Database".
Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via a crafted HTML page.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37988 ‼
📖 Read
via "National Vulnerability Database".
Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestures to potentially exploit heap corruption via a crafted HTML page.📖 Read
via "National Vulnerability Database".