🕴 Are You Planning for the Quantum, Transhumanist Threat? 🕴
📖 Read
via "Dark Reading".
Breaking encryption in a day and hacking without visible devices are two threats that could become a reality in the next decade and beyond, experts say.📖 Read
via "Dark Reading".
Dark Reading
Are You Planning for the Quantum, Transhumanist Threat?
Breaking encryption in a day and hacking without visible devices are two threats that could become a reality in the next decade and beyond, experts say.
🕴 Microsoft Fixes Exchange Server Zero-Day 🕴
📖 Read
via "Dark Reading".
November security update contains patches for 55 bugs — including six zero-days across various products.📖 Read
via "Dark Reading".
Dark Reading
Microsoft Fixes Exchange Server Zero-Day
November security update contains patches for 55 bugs — including six zero-days across various products.
‼ CVE-2021-43575 ‼
📖 Read
via "National Vulnerability Database".
** DISPUTED ** KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similar issue to CVE-2021-36799. NOTE: The vendor disputes this because it is not the responsibility of the ETS to securely store cryptographic key material when it is not being exported.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35488 ‼
📖 Read
via "National Vulnerability Database".
Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-35489 ‼
📖 Read
via "National Vulnerability Database".
Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing it.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37157 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-37158 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. An authenticated attacker could inject OS commands by starting a Counter-Strike server and using the map field to enter a Bash command.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42292 ‼
📖 Read
via "National Vulnerability Database".
Microsoft Excel Security Feature Bypass Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41366 ‼
📖 Read
via "National Vulnerability Database".
Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42304 ‼
📖 Read
via "National Vulnerability Database".
Azure RTOS Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42302, CVE-2021-42303.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42288 ‼
📖 Read
via "National Vulnerability Database".
Windows Hello Security Feature Bypass Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42279 ‼
📖 Read
via "National Vulnerability Database".
Chakra Scripting Engine Memory Corruption Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41367 ‼
📖 Read
via "National Vulnerability Database".
NTFS Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-41370, CVE-2021-42283.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41373 ‼
📖 Read
via "National Vulnerability Database".
FSLogix Information Disclosure Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41356 ‼
📖 Read
via "National Vulnerability Database".
Windows Denial of Service Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42323 ‼
📖 Read
via "National Vulnerability Database".
Azure RTOS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-26444, CVE-2021-42301.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-31853 ‼
📖 Read
via "National Vulnerability Database".
DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183) allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder.📖 Read
via "National Vulnerability Database".
🗓️ Apache Storm maintainers patch two pre-auth RCE vulnerabilities 🗓️
📖 Read
via "The Daily Swig".
High-risk issues were discovered by GitHub’s in-house security team📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Apache Storm maintainers patch two pre-auth RCE vulnerabilities
High-risk issues were discovered by GitHub’s in-house security team
‼ CVE-2021-34598 ‼
📖 Read
via "National Vulnerability Database".
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active📖 Read
via "National Vulnerability Database".
‼ CVE-2021-39474 ‼
📖 Read
via "National Vulnerability Database".
Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version 1319010201r009. The vulnerability allows an attacker with privileges and network access through the ping.cmd component to execute commands on the device.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43136 ‼
📖 Read
via "National Vulnerability Database".
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.📖 Read
via "National Vulnerability Database".