🕴 Software Makers May Face Greater Liability in Wake of MOVEit Lawsuit 🕴
📖 Read
via "Dark Reading".
Makers of vulnerable apps that are exploited in wide-scale supply chain attacks need to improve software security or face steep fines and settlement fees.📖 Read
via "Dark Reading".
Dark Reading
Software Makers May Face Greater Liability in Wake of MOVEit Lawsuit
Makers of vulnerable apps that are exploited in wide-scale supply chain attacks need to improve software security or face steep fines and settlement fees.
♟️ Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders. ♟️
📖 Read
via "Krebs on Security".
In large metropolitan areas, tourists are often easy to spot because they're far more inclined than locals to gaze upward at the surrounding skyscrapers. Security experts say this same tourist dynamic is a dead giveaway in virtually all computer intrusions that lead to devastating attacks like ransomware, and that more organizations should set simple virtual tripwires that sound the alarm when authorized users and devices are spotted exhibiting this behavior.📖 Read
via "Krebs on Security".
Krebs on Security
Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.
In large metropolitan areas, tourists are often easy to spot because they're far more inclined than locals to gaze upward at the surrounding skyscrapers. Security experts say this same tourist dynamic is a dead giveaway in virtually all computer intrusions…
⚠ Smart light bulbs could give away your password secrets ⚠
📖 Read
via "Naked Security".
Cryptography isn't just about secrecy. You need to take care of authenticity (no imposters!) and integrity (no tampering!) as well.📖 Read
via "Naked Security".
Sophos News
Naked Security – Sophos News
🦿 VMware Explore 2023: Keynote Highlights 🦿
📖 Read
via "Tech Republic".
Explore enterprise applications and infrastructure, AI, tools for the remote workforce, machine learning, and more from VMware Explore 2023.📖 Read
via "Tech Republic".
TechRepublic
VMware Explore 2023: Keynote Highlights
Explore enterprise applications and infrastructure, AI, tools for the remote workforce, machine learning, and more from VMware Explore 2023.
🕴 Newer, Better XLoader Signals a Dangerous Shift in macOS Malware 🕴
📖 Read
via "Dark Reading".
Malware aimed at macOS is no longer just a knockoff of a Windows bug, as a new infostealer proliferating on Mac laptops demonstrates.📖 Read
via "Dark Reading".
Dark Reading
Newer, Better XLoader Signals a Dangerous Shift in macOS Malware
Malware aimed at macOS is no longer just a knockoff of a Windows bug, as a new infostealer proliferating on Mac laptops demonstrates.
‼ CVE-2022-48570 ‼
📖 Read
via "National Vulnerability Database".
Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-19187 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-23804 ‼
📖 Read
via "National Vulnerability Database".
Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21426 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in function C_IStream::read in PluginEXR.cpp in FreeImage 3.18.0 allows remote attackers to run arbitrary code and cause other impacts via crafted image file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21890 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in clj_media_size function in devices/gdevclj.c in Artifex Ghostscript 9.50 allows remote attackers to cause a denial of service or other unspecified impact(s) via opening of crafted PDF document.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-21723 ‼
📖 Read
via "National Vulnerability Database".
A Segmentation Fault issue discovered StreamSerializer::extractStreams function in streamSerializer.cpp in oggvideotools 0.9.1 allows remote attackers to cause a denial of service (crash) via opening of crafted ogg file.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18839 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-46312 ‼
📖 Read
via "National Vulnerability Database".
An issue was discovered IW44EncodeCodec.cpp in djvulibre 3.5.28 in allows attackers to cause a denial of service via divide by zero.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37431 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-19185 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-37429 ‼
📖 Read
via "National Vulnerability Database".
Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit these vulnerabilities to  obtain and modify sensitive information in the underlying database potentially leading to the exposure and corruption of sensitive data controlled by the EdgeConnect SD-WAN Orchestrator host.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18232 ‼
📖 Read
via "National Vulnerability Database".
Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote attackers to run arbitrary code via creation of crafted file.📖 Read
via "National Vulnerability Database".
‼ CVE-2022-26592 ‼
📖 Read
via "National Vulnerability Database".
Stack Overflow vulnerability in libsass 3.6.5 via the CompoundSelector::has_real_parent_ref function.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-35357 ‼
📖 Read
via "National Vulnerability Database".
A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL (GNU Scientific Library), versions 2.5 and 2.6. Processing a maliciously crafted input data for gsl_stats_quantile_from_sorted_data of the library may lead to unexpected application termination or arbitrary code execution.📖 Read
via "National Vulnerability Database".
‼ CVE-2021-29390 ‼
📖 Read
via "National Vulnerability Database".
libjpeg-turbo version 2.0.90 is vulnerable to a heap-buffer-overflow vulnerability in decompress_smooth_data in jdcoefct.c.📖 Read
via "National Vulnerability Database".
‼ CVE-2020-18382 ‼
📖 Read
via "National Vulnerability Database".
Heap-buffer-overflow in /src/wasm/wasm-binary.cpp in wasm::WasmBinaryBuilder::visitBlock(wasm::Block*) in Binaryen 1.38.26. A crafted wasm input can cause a segmentation fault, leading to denial-of-service, as demonstrated by wasm-opt.📖 Read
via "National Vulnerability Database".