🕴 37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
37% Intimidated, 39% Frustrated With Online Security Highlighting Digital Anxiety
WASHINGTON – October 3, 2023 – The National Cybersecurity Alliance (NCA), the nation’s leading nonprofit empowering a more secure and interconnected world, and CybSafe, the leading behavioral risk platform, today announced the release of Oh Behave! The Annual…
🕴 Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
Okta Launches Cybersecurity Workforce Development Initiative to Help Close the Tech and Cybersecurity Skills Gap
SAN FRANCISCO — October 4, 2023 –– Okta, Inc. (NASDAQ:OKTA), the leading independent identity partner, today announced the launch of a new initiative focused on finding and developing the best cybersecurity talent and providing equitable access to thriving…
🕴 ForAllSecure Announces First Dynamic Software Bill of Materials for Application Security 🕴
📖 Read
via "Dark Reading".
📖 Read
via "Dark Reading".
Dark Reading
ForAllSecure Announces Dynamic Software Bill of Materials for Application Security
PRESS RELEASE
❤1
‼ CVE-2023-36619 ‼
📖 Read
via "National Vulnerability Database".
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43793 ‼
📖 Read
via "National Vulnerability Database".
Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentication of the Bull dashboard, which is the job queue management UI, and access it. Version 2023.9.0 contains a fix. There are no known workarounds.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42808 ‼
📖 Read
via "National Vulnerability Database".
Common Voice is the web app for Mozilla Common Voice, a platform for collecting speech donations in order to create public domain datasets for training voice recognition-related tools. Version 1.88.2 is vulnerable to reflected Cross-Site Scripting given that user-controlled data flows to a path expression (path of a network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin. As of time of publication, it is unknown whether any patches or workarounds exist.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-41094 ‼
📖 Read
via "National Vulnerability Database".
TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing durationThis issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38538 ‼
📖 Read
via "National Vulnerability Database".
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43799 ‼
📖 Read
via "National Vulnerability Database".
Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before passing them to the underlying system. Moreover, Altair GraphQL Client also does not isolate the context of the renderer process. This affects versions of the software running on MacOS, Windows, and Linux. Version 5.2.5 fixes this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-36618 ‼
📖 Read
via "National Vulnerability Database".
Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authenticated users.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42809 ‼
📖 Read
via "National Vulnerability Database".
Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue.Some post-fix advice is available. Do NOT use `Kryo5Codec` as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the `setRegistrationRequired(false)` call. On the contrary, `KryoCodec` is safe to use. The fix applied to `SerializationCodec` only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating `SerializationCodec` please use the `SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses)` constructor to restrict the allowed classes for deserialization.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44075 ‼
📖 Read
via "National Vulnerability Database".
Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43805 ‼
📖 Read
via "National Vulnerability Database".
Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can allow users to bypass authentication for access to the job queue dashboard. Version 12.121.9 contains a fix for this issue. As a workaround, it may be possible to avoid this by blocking access using tools such as Cloudflare's WAF.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-38537 ‼
📖 Read
via "National Vulnerability Database".
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44210 ‼
📖 Read
via "National Vulnerability Database".
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 29258.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44209 ‼
📖 Read
via "National Vulnerability Database".
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 29051.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-43809 ‼
📖 Read
via "National Vulnerability Database".
Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an unauthenticated, remote attacker to bypass public key authentication when keyboard-interactive SSH authentication is active, through the `allow-keyless` setting, and the public key requires additional client-side verification for example using FIDO2 or GPG. This is due to insufficient validation procedures of the public key step during SSH request handshake, granting unauthorized access if the keyboard-interaction mode is utilized. An attacker could exploit this vulnerability by presenting manipulated SSH requests using keyboard-interactive authentication mode. This could potentially result in unauthorized access to the Soft Serve. Users should upgrade to the latest Soft Serve version `v0.6.2` to receive the patch for this issue. To workaround this vulnerability without upgrading, users can temporarily disable Keyboard-Interactive SSH Authentication using the `allow-keyless` setting.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-42449 ‼
📖 Read
via "National Vulnerability Database".
Hydra is the two-layer scalability solution for Cardano. Prior to version 0.13.0, it is possible for a malicious head initializer to extract one or more PTs for the head they are initializing due to incorrect data validation logic in the head token minting policy which then results in an flawed check for burning the head ST in the `initial` validator. This is possible because it is not checked in `HeadTokens.hs` that the datums of the outputs at the `initial` validator are equal to the real head ID, and it is also not checked in the `off-chain code`.During the `Initial` state of the protocol, if the malicious initializer removes a PT from the Hydra scripts it becomes impossible for any other participant to reclaim any funds they have attempted to commit into the head, as to do so the Abort transaction must burn all the PTs for the head, but they cannot burn the PT which the attacker controls and so cannot satisfy this requirement. That means the initializer can lock the other participants committed funds forever or until they choose to return the PT (ransom).The malicious initializer can also use the PT to spoof that they have committed a particular TxO when progressing the head into the `Open` state. For example, they could say they committed a TxO residing at their address containing 100 ADA, but in fact this 100 ADA was not moved into the head, and thus in order for an other participant to perform the fanout they will be forced to pay the attacker the 100 ADA out of their own funds, as the fanout transaction must pay all the committed TxOs (even though the attacker did not really commit that TxO). They can do this by placing the PT in a UTxO with a well-formed `Commit` datum with whatever contents they like, then use this UTxO in the `collectCom` transaction. There may be other possible ways to abuse having control of a PT.Version 0.13.0 fixes this issue.📖 Read
via "National Vulnerability Database".
‼ CVE-2023-44389 ‼
📖 Read
via "National Vulnerability Database".
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6📖 Read
via "National Vulnerability Database".