‼ CVE-2021-43827 ‼
📖 Read
via "National Vulnerability Database".
discourse-footnote is a library providing footnotes for posts in Discourse. ### Impact When posting an inline footnote wrapped in `<a>` tags (e.g. `<a>^[footnote]</a>`, the resulting rendered HTML would include a nested `<a>`, which is stripped by Nokogiri because it is not valid. This then caused a javascript error on topic pages because we were looking for an `<a>` element inside the footnote reference span and getting its ID, and because it did not exist we got a null reference error in javascript. Users are advised to update to version 0.2. As a workaround editing offending posts from the rails console or the database console for self-hosters, or disabling the plugin in the admin panel can mitigate this issue.📖 Read
via "National Vulnerability Database".
🕴 Cisco's Ash Devata on Securing the Hybrid Workforce With Zero Trust 🕴
📖 Read
via "Dark Reading".
Hybrid work is here to stay, and organizations can apply zero trust's three core principles to ensure a secure workforce, Devata says.📖 Read
via "Dark Reading".
Dark Reading
Cisco's Ash Devata on Securing the Hybrid Workforce With Zero Trust
Hybrid work is here to stay, and organizations can apply zero trust's three core principles to ensure a secure workforce, Devata says.
🦿 Log4j vulnerability: Why your hot take on it is wrong 🦿
📖 Read
via "Tech Republic".
Commentary: Those searching for a single cause for the Log4j vulnerability – whether it's open source is not secure, or open source is not sustainable – are getting it wrong. It's a complicated issue.📖 Read
via "Tech Republic".
TechRepublic
Log4j vulnerability: Why your hot take on it is wrong
Commentary: Those searching for a single cause for the Log4j vulnerability – whether it's open source is not secure, or open source is not sustainable – are getting it wrong. It's a complicated issue.
❌ Apache’s Fix for Log4Shell Can Lead to DoS Attacks ❌
📖 Read
via "Threat Post".
Not only is the jaw-dropping flaw in the Apache Log4j logging library ubiquitous; Apache’s blanket of a quickly baked patch for Log4Shell also has holes.📖 Read
via "Threat Post".
Threat Post
Apache’s Fix for Log4Shell Can Lead to DoS Attacks
Not only is the jaw-dropping flaw in the Apache Log4j logging library ubiquitous; Apache’s blanket of a quickly baked patch for Log4Shell also has holes.
🕴 Kryptowire Collaborates With Orange and Finds Vulnerabilities in Mobile Devices 🕴
📖 Read
via "Dark Reading".
Kryptowire’s end-to-end cybersecurity engine identified vulnerabilities granting system user-level privileges for arbitrary shell script execution.📖 Read
via "Dark Reading".
Dark Reading
Kryptowire Collaborates With Orange and Finds Vulnerabilities in Mobile Devices
Kryptowire’s end-to-end cybersecurity engine identified vulnerabilities granting system user-level privileges for arbitrary shell script execution.
‼ CVE-2021-4116 ‼
📖 Read
via "National Vulnerability Database".
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20330 ‼
📖 Read
via "National Vulnerability Database".
An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.25; MongoDB Server v4.2 versions prior to 4.2.14; MongoDB Server v4.4 versions prior to 4.4.6.📖 Read
via "National Vulnerability Database".
🕴 Why Cloud Storage Isn't Immune to Ransomware 🕴
📖 Read
via "Dark Reading".
Cloud security is a shared responsibility. which sometimes leads to security gaps and complexity in risk management.📖 Read
via "Dark Reading".
Dark Reading
Why Cloud Storage Isn't Immune to Ransomware
Cloud security is a shared responsibility. which sometimes leads to security gaps and complexity in risk management.
🛠 OpenSSL Toolkit 1.1.1m 🛠
📖 Read
via "Packet Storm Security".
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.📖 Read
via "Packet Storm Security".
Packetstormsecurity
OpenSSL Toolkit 1.1.1m ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
🗓️ US government launches ‘Hack the DHS’ bug bounty program 🗓️
📖 Read
via "The Daily Swig".
Initiative will also invite selected security researchers to a live hacking event📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
US government launches ‘Hack the DHS’ bug bounty program
Initiative will also invite selected security researchers to a live hacking event
🕴 Why We Need "Developer-First" Application Security 🕴
📖 Read
via "Dark Reading".
The way to improve the security of the modern software development life cycle and reduce the number of application-based breaches is to re-center app security around the needs of developers.📖 Read
via "Dark Reading".
Dark Reading
Why We Need "Developer-First" Application Security
The way to improve the security of the modern software development life cycle and reduce the number of application-based breaches is to re-center app security around the needs of developers.
🗓️ Log4j: Security pros call for urgent patch implementation as in-the-wild exploitation continues 🗓️
📖 Read
via "The Daily Swig".
Initial, ‘incomplete’ patch created path to denial-of-service attacks📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
Log4j: Security pros call for urgent patch implementation as in-the-wild exploitation continues
Initial, ‘incomplete’ patch created path to denial-of-service attacks
🦿 Kodachi is the operating system for those who value privacy but don't want to learn Linux 🦿
📖 Read
via "Tech Republic".
For anyone looking to gain an extra layer of privacy on a desktop or laptop, Kodachi Linux might be the perfect option. Jack Wallen highlights this live Linux distribution.📖 Read
via "Tech Republic".
TechRepublic
Kodachi is the operating system for those who value privacy but don’t want to learn Linux
For anyone looking to gain an extra layer of privacy on a desktop or laptop, Kodachi Linux might be the perfect option. Jack Wallen highlights this live Linux distribution.
🦿 Just in time for Christmas, Kronos payroll and HR cloud software goes offline due to ransomware 🦿
📖 Read
via "Tech Republic".
The attack has led to an outage expected to last weeks, leaving companies scrambling to make payroll with the holidays right around the corner.📖 Read
via "Tech Republic".
TechRepublic
Just in time for Christmas, Kronos payroll and HR cloud software goes offline due to ransomware
The attack has led to an outage expected to last weeks, leaving companies scrambling to make payroll with the holidays right around the corner.
🛠 Log4j Recognizer 🛠
📖 Read
via "Packet Storm Security".
This utility looks for log4j in the currently running JVM. It is useful for systems that allow plugins to introduce their own jars. Therefore, you can find if someone is using log4j with a dangerous version.📖 Read
via "Packet Storm Security".
Packetstormsecurity
Log4j Recognizer ≈ Packet Storm
Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
‼ CVE-2021-43237 ‼
📖 Read
via "National Vulnerability Database".
Windows Setup Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43893 ‼
📖 Read
via "National Vulnerability Database".
Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43227 ‼
📖 Read
via "National Vulnerability Database".
Storage Spaces Controller Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-43235.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43877 ‼
📖 Read
via "National Vulnerability Database".
ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-43907 ‼
📖 Read
via "National Vulnerability Database".
Visual Studio Code WSL Extension Remote Code Execution Vulnerability📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41333 ‼
📖 Read
via "National Vulnerability Database".
Windows Print Spooler Elevation of Privilege Vulnerability📖 Read
via "National Vulnerability Database".