🕴 OMB Issues Zero-Trust Strategy for Federal Agencies 🕴
📖 Read
via "Dark Reading".
Federal officials tout the strategy as a more proactive approach to securing government networks.📖 Read
via "Dark Reading".
Dark Reading
OMB Issues Zero-Trust Strategy for Federal Agencies
Federal officials tout the strategy as a more proactive approach to securing government networks.
❌ TrickBot Crashes Security Researchers’ Browsers in Latest Upgrade ❌
📖 Read
via "Threat Post".
The malware has added an anti-debugging tool that crashes browser tabs when researchers use code beautifying for analysis.📖 Read
via "Threat Post".
Threat Post
TrickBot Crashes Security Researchers’ Browsers in Latest Upgrade
The malware has added an anti-debugging tool that crashes browser tabs when researchers use code beautifying for analysis.
‼ CVE-2021-32849 ‼
📖 Read
via "National Vulnerability Database".
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32840 ‼
📖 Read
via "National Vulnerability Database".
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry `../evil.txt` may be extracted in the parent directory of `destFolder`. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32841 ‼
📖 Read
via "National Vulnerability Database".
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.3.0 and prior to version 1.3.3, a check was added if the destination file is under destination directory. However, it is not enforced that `destDir` ends with slash. If the `destDir` is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins with the destination directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 contains a patch for this vulnerability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23967 ‼
📖 Read
via "National Vulnerability Database".
In TightVNC 1.3.10, there is an integer signedness error and resultant heap-based buffer overflow in InitialiseRFBConnection in rfbproto.c (for the vncviewer component). There is no check on the size given to malloc, e.g., -1 is accepted. This allocates a chunk of size zero, which will give a heap pointer. However, one can send 0xffffffff bytes of data, which can have a DoS impact or lead to remote code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-32842 ‼
📖 Read
via "National Vulnerability Database".
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Starting version 1.0.0 and prior to version 1.3.3, a check was added if the destination file is under a destination directory. However, it is not enforced that `_baseDirectory` ends with slash. If the _baseDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints, the arbitrary file creation impact is limited and depends on the use case. Version 1.3.3 fixed this vulnerability.📖 Read
via "National Vulnerability Database".
🕴 Millions of Routers, IoT Devices at Risk as Malware Source Code Surfaces on GitHub 🕴
📖 Read
via "Dark Reading".
"BotenaGo" contains exploits for more than 30 vulnerabilities in multiple vendor products and is being used to spread Mirai botnet malware, security vendor says.📖 Read
via "Dark Reading".
Dark Reading
Millions of Routers, IoT Devices at Risk as Malware Source Code Surfaces on GitHub
"BotenaGo" contains exploits for more than 30 vulnerabilities in multiple vendor products and is being used to spread Mirai botnet malware, security vendor says.
🕴 ArmorCode Closes $11 Million Seed Funding Round 🕴
📖 Read
via "Dark Reading".
Company will use new funds to extend its AppSecOps platform capabilities.📖 Read
via "Dark Reading".
Dark Reading
ArmorCode Closes $11 Million Seed Funding Round
Company will use new funds to extend its AppSecOps platform capabilities.
🕴 IT Pros May Use Cloud, But They Trust On-Prem More 🕴
📖 Read
via "Dark Reading".
While opinions about the trustworthiness of the cloud are split, everyone believes that's where hackers will focus their efforts.📖 Read
via "Dark Reading".
Dark Reading
IT Pros May Use Cloud, But They Trust On-Prem More
While opinions about the trustworthiness of the cloud are split, everyone believes that's where hackers will focus their efforts.
‼ CVE-2022-21722 ‼
📖 Read
via "National Vulnerability Database".
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.11.1 and prior, there are various cases where it is possible that certain incoming RTP/RTCP packets can potentially cause out-of-bound read access. This issue affects all users that use PJMEDIA and accept incoming RTP/RTCP. A patch is available as a commit in the `master` branch. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-41166 ‼
📖 Read
via "National Vulnerability Database".
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may lead to sensitive information disclosure. An unauthorized app that does not have the otherwise required `MANAGE_DOCUMENTS` permission may view image thumbnails for images it does not have permission to view. Version 3.17.1 contains a patch. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21723 ‼
📖 Read
via "National Vulnerability Database".
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In versions 2.11.1 and prior, parsing an incoming SIP message that contains a malformed multipart can potentially cause out-of-bound read access. This issue affects all PJSIP users that accept SIP multipart. The patch is available as commit in the `master` branch. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0370 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-22828 ‼
📖 Read
via "National Vulnerability Database".
An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0387 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-0372 ‼
📖 Read
via "National Vulnerability Database".
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.📖 Read
via "National Vulnerability Database".
❌ How to Secure Your SaaS Stack with a SaaS Security Posture Management Solution ❌
📖 Read
via "Threat Post".
SaaS Security Posture Management (SSPM) named a must have solution by Gartner. Adaptive Shields SSPM solution allows security teams full visibility and control.📖 Read
via "Threat Post".
Threat Post
How to Secure Your SaaS Stack with a SaaS Security Posture Management Solution
SaaS Security Posture Management (SSPM) named a must have solution by Gartner. Adaptive Shields SSPM solution allows security teams full visibility and control.
🗓️ DeepDotWeb administrator gets eight-year stretch in US prison for money laundering 🗓️
📖 Read
via "The Daily Swig".
Tal Prihar pleaded guilty to his role in darknet kickback scheme last year📖 Read
via "The Daily Swig".
The Daily Swig | Cybersecurity news and views
DeepDotWeb administrator gets eight-year stretch in US prison for money laundering
Tal Prihar pleaded guilty to his role in darknet kickback scheme last year
⚠ “PwnKit” security bug gets you root on most Linux distros – what to do ⚠
📖 Read
via "Naked Security".
An elevation of privilege bug that could let a "mostly harmless" user give themselves a instant root shell📖 Read
via "Naked Security".
Naked Security
“PwnKit” security bug gets you root on most Linux distros – what to do
An elevation of privilege bug that could let a “mostly harmless” user give themselves a instant root shell
⚠ Apple patches Safari data leak (oh, and a zero-day) – patch now! ⚠
📖 Read
via "Naked Security".
That infamous "supercookie" bug in Safari has now been fixed. Oh, and there was a zero-day kernel hole as well.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News