‼ CVE-2021-20319 ‼
📖 Read
via "National Vulnerability Database".
An improper signature verification vulnerability was found in coreos-installer. A specially crafted gzip installation image can bypass the image signature verification and as a consequence can lead to the installation of unsigned content. An attacker able to modify the original installation image can write arbitrary data, and achieve full access to the node being installed.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3575 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23233 ‼
📖 Read
via "National Vulnerability Database".
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS) of the Local Distribution Router (LDR) service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20300 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-21828 ‼
📖 Read
via "National Vulnerability Database".
A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-3428 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20303 ‼
📖 Read
via "National Vulnerability Database".
A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-20302 ‼
📖 Read
via "National Vulnerability Database".
A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-23232 ‼
📖 Read
via "National Vulnerability Database".
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited could allow disabled, expired, or locked external user accounts to access S3 data to which they previously had access. StorageGRID 11.6.0 obtains the user account status from Active Directory or Azure and will block S3 access for disabled user accounts during the subsequent background synchronization. User accounts that are expired or locked for Active Directory or Azure, or user accounts that are disabled, expired, or locked in identity sources other than Active Directory or Azure must be manually removed from group memberships or have their S3 keys manually removed from Tenant Manager in all versions of StorageGRID (formerly StorageGRID Webscale).📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26318 ‼
📖 Read
via "National Vulnerability Database".
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulnerability impacts Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2.📖 Read
via "National Vulnerability Database".
📢 China's "most advanced" malware uncovered after nine years in operation 📢
📖 Read
via "ITPro".
Daxin appears to be have used in a long-running espionage campaign against select government and critical infrastructure targets📖 Read
via "ITPro".
ITPro
China's "most advanced" malware uncovered after nine years in operation
Daxin appears to be have used in a long-running espionage campaign against select government and critical infrastructure targets
📢 Nvidia confirms data breach as hackers make additional demands 📢
📖 Read
via "ITPro".
Nvidia has confirmed a rumoured hack on its systems for the first time as the first part of the alleged 1TB of company secrets is made available to download📖 Read
via "ITPro".
ITPro
Nvidia confirms data breach as hackers make additional demands
Nvidia has confirmed a rumoured hack on its systems for the first time as the first part of the alleged 1TB of company secrets is made available to download
📢 The importance of a zero-trust model for hybrid working 📢
📖 Read
via "ITPro".
How identity-based security solutions can help protect our dispersed workforces📖 Read
via "ITPro".
ITPro
The importance of a zero-trust model for hybrid working
How identity-based security solutions can help protect our dispersed workforces
📢 Conti source code leaked by Ukrainian researcher 📢
📖 Read
via "ITPro".
Source code hits the public domain as fallout continues over ransomware group's support for Russia📖 Read
via "ITPro".
IT PRO
Conti source code leaked by Ukrainian researcher | IT PRO
Source code hits the public domain as fallout continues over ransomware group's support for Russia
📢 Why is the healthcare industry so vulnerable to ransomware? 📢
📖 Read
via "ITPro".
Hospitals and other healthcare institutions must invest in cutting-edge backup solutions to protect themselves and their patients’ data📖 Read
via "ITPro".
IT PRO
Why is the healthcare industry so vulnerable to ransomware? | IT PRO
Hospitals and other healthcare institutions must invest in cutting-edge backup solutions to protect themselves and their patients’ data
👍1
📢 Singapore to launch digital defence agency to counter growing cyber threats 📢
📖 Read
via "ITPro".
Russian cyber tactics in Ukraine cited as reason behind new military arm📖 Read
via "ITPro".
IT PRO
Singapore to launch digital defence agency to counter growing cyber threats | IT PRO
Russian cyber tactics in Ukraine cited as reason behind new military arm
📢 How Telegram became Ukraine's biggest digital ally in the war 📢
📖 Read
via "ITPro".
The messaging app has experienced a surge in demand as users flock to the platform for news and instructions on how to participate in the effort to thwart Russia's invasion📖 Read
via "ITPro".
IT PRO
How Telegram became Ukraine's biggest digital ally in the war | IT PRO
The messaging app has experienced a surge in demand as users flock to the platform for news and instructions on how to participate in the effort to thwart Russia's invasion
📢 Big Tech enters fight against Russia's multi-pronged cyber offensive 📢
📖 Read
via "ITPro".
Microsoft, Google, Meta, and Twitter have implemented measures to help dampen the impact of Russia's cyber attacks on Ukraine📖 Read
via "ITPro".
ITPro
Big Tech enters fight against Russia's multi-pronged cyber offensive
Microsoft, Google, Meta, and Twitter have implemented measures to help dampen the impact of Russia's cyber attacks on Ukraine
📢 MWC 2022: Ukrainian protesters call for Russian tech boycott 📢
📖 Read
via "ITPro".
The protestors are urging AWS to “shut down” servers being used by Russian entities📖 Read
via "ITPro".
IT PRO
MWC 2022: Ukrainian protesters call for Russian tech boycott | IT PRO
The protestors are urging AWS to “shut down” servers being used by Russian entities
📢 Cyber attacks against the BBC increase 35% in two years 📢
📖 Read
via "ITPro".
The broadcaster said it fended off nearly 50 million cyber attacks in just four months across 2021 and 2022📖 Read
via "ITPro".
IT PRO
Cyber attacks against the BBC increase 35% in two years | IT PRO
The broadcaster said it fended off nearly 50 million cyber attacks in just four months across 2021 and 2022
♟️ Conti Ransomware Group Diaries, Part III: Weaponry ♟️
📖 Read
via "Krebs on Security".
Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what it's like to be an employee of Conti's sprawling organization. Today's Part III looks at how Conti abused a panoply of popular commercial security services to undermine the security of their targets, as well as how the team’s leaders strategized for the upper hand in ransom negotiations with victims.📖 Read
via "Krebs on Security".
Krebsonsecurity
Conti Ransomware Group Diaries, Part III: Weaponry
Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what it's like to be an employee of Conti's sprawling organization. Today's…