‼ CVE-2023-5371 ‼
📖 Read
via "National Vulnerability Database".
RTPS dissector memory leak in Wireshark 4.0.0 to 4.0.8 and 3.6.0 to 3.6.16 allows denial of service via packet injection or crafted capture file📖 Read
via "National Vulnerability Database".
🕴 On the Dark Web, Prices Are Down for Middle Eastern Network Access 🕴
📖 Read
via "Dark Reading".
A mere $35 can buy you stealth access to corporate networks across the region, according to new research.📖 Read
via "Dark Reading".
Dark Reading
On the Dark Web, Prices Are Down for Middle Eastern Network Access
A mere $35 can buy you stealth access to corporate networks across the region, according to new research.
🕴 AWS Plans Multifactor Authentication Mandates for 2024 🕴
📖 Read
via "Dark Reading".
Amazon will add new MFA requirements for users with the highest privileges, with plans to include other user levels over time. 📖 Read
via "Dark Reading".
Dark Reading
AWS Plans Multifactor Authentication Mandates for 2024
Amazon will add new MFA requirements for users with the highest privileges, with plans to include other user levels over time.
🕴 Bing Chat LLM Tricked into Circumventing CAPTCHA Filter 🕴
📖 Read
via "Dark Reading".
By reframing the narrative of the filter, the large-language model chatbot was more willing to solve the visual puzzle and override its programming.📖 Read
via "Dark Reading".
Dark Reading
Bing Chat LLM Tricked Into Circumventing CAPTCHA Filter
By reframing the narrative of the filter, the large-language model chatbot was more willing to solve the visual puzzle and override its programming.
‼ CVE-2023-5391 ‼
📖 Read
via "National Vulnerability Database".
A?CWE-502:?Deserialization of untrusted data?vulnerability exists?that could allow an attacker to execute arbitrary code on the targeted system by sending a specifically crafted packet to the application. 📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3428 ‼
📖 Read
via "National Vulnerability Database".
A heap-based buffer overflow vulnerability was found in coders/tiff.c in ImageMagick. This issue may allow a local attacker to trick the user into opening a specially crafted file, resulting in an application crash and denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-3576 ‼
📖 Read
via "National Vulnerability Database".
A memory leak flaw was found in Libtiff's tiffcrop utility. This issue occurs when tiffcrop operates on a TIFF image file, allowing an attacker to pass a crafted TIFF image file to tiffcrop utility, which causes this memory leak issue, resulting an application crash, eventually leading to a denial of service.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-39191 ‼
📖 Read
via "National Vulnerability Database".
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42448 ‼
📖 Read
via "National Vulnerability Database".
Hydra is the layer-two scalability solution for Cardano. Prior to version 0.13.0, the specification states that the contestation period in the datum of the UTxO at the head validator must stay unchanged as the state progresses from Open to Closed (Close transaction), but no such check appears to be performed in the `checkClose` function of the head validator. This would allow a malicious participant to modify the contestation deadline of the head to either allow them to fanout the head without giving another participant the chance to contest, or prevent any participant from ever redistributing the funds locked in the head via a fan-out. Version 0.13.0 contains a patch for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5402 ‼
📖 Read
via "National Vulnerability Database".
A?CWE-269: Improper Privilege Management vulnerability exists?that could cause?a local privilege escalation?when the transfer command is used.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38701 ‼
📖 Read
via "National Vulnerability Database".
Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the `commit` validator, where they remain until they are either collected into the `head` validator or the protocol initialisation is aborted and the value in the committed UTxOs is returned to the users who committed them. Prior to version 0.12.0, the `commit` validator contains a flawed check when the `ViaAbort` redeemer is used, which allows any user to spend any UTxO which is at the validator arbitrarily, meaning an attacker can steal the funds that users are trying to commit into the head validator. The intended behavior is that the funds must be returned to the user which committed the funds and can only be performed by a participant of the head. The `initial` validator also is similarly affected as the same flawed check is performed for the `ViaAbort` redeemer. Due to this issue, an attacker can steal any funds that user's try to commit into a Hydra head. Also, an attacker can prevent any Hydra head from being successfully opened. It does not allow an attacker to take funds which have been successfully collected into and currently reside in the `head` validator. Version 0.12.0 contains a fix for this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-27121 ‼
📖 Read
via "National Vulnerability Database".
A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v7.11.41.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cronString parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42824 ‼
📖 Read
via "National Vulnerability Database".
The issue was addressed with improved checks. This issue is fixed in iOS 17.0.3 and iPadOS 17.0.3. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-5399 ‼
📖 Read
via "National Vulnerability Database".
A?CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')?vulnerability exists?that could cause?a path traversal issue?when?using the File Command. 📖 Read
via "National Vulnerability Database".
🕴 37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety
WASHINGTON – October 3, 2023 – The National Cybersecurity Alliance (NCA), the nation’s leading nonprofit empowering a more secure and interconnected world, and CybSafe, the leading behavioral risk platform, today announced the release of Oh Behave! The Annual…
🕴 Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap
SAN FRANCISCO — October 4, 2023 –– Okta, Inc. (NASDAQ:OKTA), the leading independent identity partner, today announced the launch of a new initiative focused on finding and developing the best cybersecurity talent and providing equitable access to thriving…
🕴 ForAllSecure Announces First Dynamic Software Bill of Materials for Application Security 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
ForAllSecure Announces Dynamic Software Bill of Materials for Application Security
PRESS RELEASE
❤1
‼ CVE-2023-36619 ‼
📖 Read
via "National Vulnerability Database".
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.📖 Read
via "National Vulnerability Database".