‼ CVE-2022-24968 ‼
📖 Read
via "National Vulnerability Database".
In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46365 ‼
📖 Read
via "National Vulnerability Database".
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted XLF file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46361 ‼
📖 Read
via "National Vulnerability Database".
An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46364 ‼
📖 Read
via "National Vulnerability Database".
A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46362 ‼
📖 Read
via "National Vulnerability Database".
A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46363 ‼
📖 Read
via "National Vulnerability Database".
An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted CSV/XLS file.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46366 ‼
📖 Read
via "National Vulnerability Database".
An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23633 ‼
📖 Read
via "National Vulnerability Database".
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23634 ‼
📖 Read
via "National Vulnerability Database".
Puma is a Ruby/Rack web server built for parallelism. Prior to `puma` version `5.6.2`, `puma` may not always call `close` on the response body. Rails, prior to version `7.0.2.2`, depended on the response body being closed in order for its `CurrentAttributes` implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails _or_ Puma version fixes the vulnerability.📖 Read
via "National Vulnerability Database".
📢 Sophos to launch new data centre in Mumbai 📢
📖 Read
via "ITPro".
The cyber security company will help organisations to comply with strict data sovereignty laws and regulations📖 Read
via "ITPro".
IT PRO
Sophos to launch new data centre in Mumbai | IT PRO
The cyber security company will help organisations to comply with strict data sovereignty laws and regulations
📢 Google Cloud adds cryptomining protection following widespread exploitation 📢
📖 Read
via "ITPro".
In nearly all cases of compromised Google Cloud instances, cryptomining malware was installed within 22 seconds📖 Read
via "ITPro".
IT PRO
Google Cloud adds cryptomining protection following widespread exploitation | IT PRO
In nearly all cases of compromised Google Cloud instances, cryptomining malware was installed within 22 seconds
📢 Linux-based multi-cloud environments facing increased ransomware attacks 📢
📖 Read
via "ITPro".
VMware researchers claim not enough effort is being spent on developing countermeasures for attacks on the cloud's most popular operating system📖 Read
via "ITPro".
IT PRO
Linux-based multi-cloud environments facing increased ransomware attacks | IT PRO
VMware researchers claim not enough effort is being spent on developing countermeasures for attacks on the cloud's most popular operating system
📢 Washington State Department of Licensing hit by suspected data breach 📢
📖 Read
via "ITPro".
The DOL temporarily disabled its POLARIS system to investigate a possible breach📖 Read
via "ITPro".
IT PRO
Washington State Department of Licensing hit by suspected data breach | IT PRO
The DOL temporarily disabled its POLARIS system to investigate a possible breach
📢 Apple bug allowed iPhones to inadvertently record Siri interactions 📢
📖 Read
via "ITPro".
The flaw stored Siri recordings even if a user had opted out📖 Read
via "ITPro".
IT PRO
Apple bug allowed iPhones to inadvertently record Siri interactions | IT PRO
The flaw stored Siri recordings even if a user had opted out
📢 Online Safety Bill will require porn sites to verify age of UK users 📢
📖 Read
via "ITPro".
However, internet users are concerned the proposal will threaten online privacy and open new opportunities for blackmail📖 Read
via "ITPro".
ITPro
Online Safety Bill will require porn sites to verify age of UK users
However, internet users are concerned the proposal will threaten online privacy and open new opportunities for blackmail
📢 Building IT antibodies to fight future shocks 📢
📖 Read
via "ITPro".
As enterprises look towards their post-COVID futures, they must ensure their IT systems are robust, secure, and resilient📖 Read
via "ITPro".
ITPro
Building IT antibodies to fight future shocks
As enterprises look towards their post-COVID futures, they must ensure their IT systems are robust, secure, and resilient
📢 Google claims default 2FA reduced account breaches by 50% 📢
📖 Read
via "ITPro".
The auto-enabled security mechanism was first introduced late last year📖 Read
via "ITPro".
ITPro
Google claims default 2FA reduced account breaches by 50%
The auto-enabled security mechanism was first introduced late last year
📢 US seizes record $3.6 billion in Bitcoin from Bitfinex hack 📢
📖 Read
via "ITPro".
The FBI has also arrested a married couple for allegedly conspiring to launder the stolen cryptocurrency📖 Read
via "ITPro".
IT PRO
US seizes record $3.6 billion in Bitcoin from Bitfinex hack | IT PRO
The FBI has also arrested a married couple for allegedly conspiring to launder the stolen cryptocurrency
📢 US indicts Indian call center scammers 📢
📖 Read
via "ITPro".
Six call centers were responsible for millions of IRS and loan fraud scams, says DoJ📖 Read
via "ITPro".
IT PRO
US indicts Indian call center scammers | IT PRO
Six call centers were responsible for millions of IRS and loan fraud scams, says DoJ
📢 Foreign Office hit by “serious cyber security incident” 📢
📖 Read
via "ITPro".
The department sought urgent assistance from its security contractor in light of the "emergency"📖 Read
via "ITPro".
IT PRO
Foreign Office hit by “serious cyber security incident” | IT PRO
The department sought urgent assistance from its security contractor in light of the "emergency"
📢 Microsoft's Patch Tuesday fixes 70 vulnerabilities after a troublesome January update 📢
📖 Read
via "ITPro".
Microsoft will be hoping for a bug-free round of patches after admins complained of January's updates breaking more components than they fixed📖 Read
via "ITPro".
ITPro
Microsoft's Patch Tuesday fixes 70 vulnerabilities after a troublesome January update
Microsoft will be hoping for a bug-free round of patches after admins complained of January's updates breaking more components than they fixed