‼ CVE-2021-25985 ‼
📖 Read
via "National Vulnerability Database".
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29861 ‼
📖 Read
via "National Vulnerability Database".
IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS to expose sensitive information. IBM X-Force ID: 206085.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-26323 ‼
📖 Read
via "National Vulnerability Database".
Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-24802 ‼
📖 Read
via "National Vulnerability Database".
The Colorful Categories WordPress plugin before 2.0.15 does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41266 ‼
📖 Read
via "National Vulnerability Database".
Minio console is a graphical user interface for the for MinIO operator. Minio itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. All users on release v0.12.2 and before are affected and are advised to update to 0.12.3 or newer. Users unable to upgrade should add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLE_IDP_URL, CONSOLE_IDP_CLIENT_ID, CONSOLE_IDP_SECRET and CONSOLE_IDP_CALLBACK environment variable and instead use the Kubernetes service account token.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42373 ‼
📖 Read
via "National Vulnerability Database".
A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42721 ‼
📖 Read
via "National Vulnerability Database".
Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious M4A file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42374 ‼
📖 Read
via "National Vulnerability Database".
An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that📖 Read
via "National Vulnerability Database".
‼ CVE-2020-12902 ‼
📖 Read
via "National Vulnerability Database".
Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-42377 ‼
📖 Read
via "National Vulnerability Database".
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.📖 Read
via "National Vulnerability Database".
⚠ Emotet malware: “The report of my death was an exaggeration” ⚠
📖 Read
via "Naked Security".
"Old malware rarely dies." The best way to predict the future is to look at the past... if it worked before, it will probably work again.📖 Read
via "Naked Security".
Naked Security
Emotet malware: “The report of my death was an exaggeration”
“Old malware rarely dies.” The best way to predict the future is to look at the past… if it worked before, it will probably work again.
⚠ The self-driving smart suitcase… that the person behind you can hijack! ⚠
📖 Read
via "Naked Security".
Apparently, we need a self-driving IoT Bluetooth robot suitcase. Who knew?📖 Read
via "Naked Security".
Naked Security
The self-driving smart suitcase… that the person behind you can hijack!
Apparently, we need a self-driving IoT Bluetooth robot suitcase. Who knew?
🦿 Your weak passwords can be cracked in less than a second 🦿
📖 Read
via "Tech Republic".
Easy-to-crack phrases "123456," "123456789," "12345," "qwerty" and "password" are the five most common passwords, says NordPass.📖 Read
via "Tech Republic".
TechRepublic
Your weak passwords can be cracked in less than a second
Easy-to-crack phrases "123456," "123456789," "12345," "qwerty" and "password" are the five most common passwords, says NordPass.
🦿 How to protect your organization from ransomware attacks during the holiday season 🦿
📖 Read
via "Tech Republic".
A quarter of security pros polled by Cybereason said they lack a plan to deal with a ransomware attack during a weekend or holiday.📖 Read
via "Tech Republic".
TechRepublic
How to protect your organization from ransomware attacks during the holiday season
A quarter of security pros polled by Cybereason said they lack a plan to deal with a ransomware attack during a weekend or holiday.
‼ CVE-2021-42250 ‼
📖 Read
via "National Vulnerability Database".
Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-40745 ‼
📖 Read
via "National Vulnerability Database".
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arbitrary server files. By leveraging an exposed XML file, an unauthenticated attacker can enumerate other files on the server.📖 Read
via "National Vulnerability Database".
🕴 Is XDR Overhyped? 🕴
📖 Read
via "Dark Reading".
Security experts weigh in on the value and pitfalls of extended detection and response (XDR), offering consideration and advice on this growing new category.📖 Read
via "Dark Reading".
Dark Reading
Is XDR Overhyped?
Security experts weigh in on the value and pitfalls of extended detection and response (XDR), offering consideration and advice on this growing new category.
❌ Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns ❌
📖 Read
via "Threat Post".
Meanwhile, a Microsoft analysis that followed six Iranian threat actor groups for over a year found them increasingly sophisticated, adapting and thriving.📖 Read
via "Threat Post".
Threat Post
Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns
Meanwhile, a Microsoft analysis that followed six Iranian threat actor groups for over a year found them increasingly sophisticated, adapting and thriving.
⚠ Apple’s Privacy Protection feature – watch out if you have a Watch! ⚠
📖 Read
via "Naked Security".
Apple's "Protect Mail Activity" is a handy privacy enhancement for your messaging habits. As long as you know its limitations...📖 Read
via "Naked Security".
Naked Security
Apple’s Mail Privacy Protection feature – watch out if you have a Watch!
Apple’s “Protect Mail Activity” is a handy privacy enhancement for your messaging habits. As long as you know its limitations…
🗓️ Secure development: New and improved Linux Random Number Generator ready for testing 🗓️
📖 Read
via "The Daily Swig".
Proposed replacement for /dev/random promises to double performance and add flexibility📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Secure development: New and improved Linux Random Number Generator ready for testing
Proposed replacement for /dev/random promises to double performance and add flexibility
🦿 How to beef up your multicloud security 🦿
📖 Read
via "Tech Republic".
A majority of IT leaders surveyed by Valtix said they realize their employees lack the necessary skills to manage multicloud security.📖 Read
via "Tech Republic".
TechRepublic
How to beef up your multicloud security
A majority of IT leaders surveyed by Valtix said they realize their employees lack the necessary skills to manage multicloud security.