CVE-2021-29952

Summary: CVE-2021-29952 affects Mozilla Firefox and Firefox for Android. A race condition during the destruction of Web Render components could cause undefined behavior and, with sufficient effort, potentially be exploited to run arbitrary code. Affected versions: Firefox < 88.0.1 and Firefox ...

Helm passes repository credentials to alternate domain

While working on the Helm source, a Helm core maintainer discovered a situation where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. Impact The index.yaml within a Helm chart repository contains a...

GHSA-56HP-XQP3-W2JF Helm passes repository credentials to alternate domain

While working on the Helm source, a Helm core maintainer discovered a situation where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. Impact The index.yaml within a Helm chart repository contains a...

Arbitrary File Read Vulnerability in NBR6210-E

NBR6210-E is an Internet Behavior Management router from Riptide, which is designed for office full scenarios. The NBR6210-E suffers from an arbitrary file read vulnerability that can be exploited by an attacker to read arbitrary system files...

Race condition

There is a race condition vulnerability in eCNS280TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal...

CVE-2021-22378

There is a race condition vulnerability in eCNS280TD V100R005C00 and V100R005C10. There is a timing window exists in which the database can be operated by another thread that is operating concurrently. Successful exploit may cause the affected device abnormal...

Hotel staff bust Hermes SMS scammer with suspiciously large number of cables

If you’re in the UK, you’ve likely received a fake delivery SMS at this point. The original big driver for this over the pandemic was a non-stop wave of Royal Mail phishing scams. As that article mentions, most if not all of our interactions with organisations is done by mobile. I receive medical...

Privilege escalation

In onReceive of NetInitiatedActivity.java, there is a possible way to supply an attacker-controlled value to a GPS HAL handler due to a missing permission check. This could lead to local escalation of privilege that may result in undefined behavior in some HAL implementations with no additional...

SUSE SLES15: apache2 / apache2-devel / apache2-doc / apache2-prefork / etc (SUSE-SU-2021:2004-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2004-1 advisory. - CVE-2021-30641: Fixed MergeSlashes regression bsc1187174 - CVE-2021-31618: Fixed NULL pointer dereference on specially crafted...

Command Execution Vulnerability in Tianrongxin Internet Behavior Management System

Tianrongxin is a leading provider of information security products and service solutions in China. A command execution vulnerability exists in Tianrongxin Internet Behavior Management System IBMS, which can be exploited by a remote attacker to submit a special request to execute arbitrary command...

Ubuntu 16.04 ESM : Apache HTTP Server vulnerabilities (USN-4994-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4994-2 advisory. USN-4994-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has...

Arbitrary File Download Vulnerability in Internet Behavior Management System of Tianrongxin Technology Group

Founded on August 30, 1985, Skyrise Technology Group, or "Skyrise" for short, is a leading provider of network security, big data and security cloud services in China. An arbitrary file download vulnerability exists in the Internet behavior management system of Tianrongxin Technology Group. An...

UBUNTU-CVE-2021-3608

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMAREGDSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The...

Origin Validation Error in Apache Maven

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

GHSA-2F88-5HG8-9X2X Origin Validation Error in Apache Maven

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model pom which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository...

Arbitrary File Read Vulnerability in Fiberhome Network Behavior Audit System

Established in 1999, Fiberhome Communication Technology Co., Ltd. is currently the only scientific research and industrial entity integrating three strategic technologies in the field of optical communication in China. An arbitrary file read vulnerability exists in Fiberhome Network Behavior Audi...

Deposit whitelist enforced on msg.sender instead of user

Handle 0xRajeev Vulnerability details Impact The Treasury deposit function credits amount to the user address in parameter instead of the msgSender that is actually making the deposit whose rationale as explained in the Natspec comment is that this may be called via contract or L1-L2 bot. However...

Security update for libopenmpt (moderate)

openSUSE Security Update: Security update for libopenmpt Announcement ID: openSUSE-SU-2021:0885-1 Rating: moderate References: 1186663 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for libopenmpt fixes the following...

Insider Risks In the Work-From-Home World

The employee who exfiltrated data after being fired. The employees who exposed 250 million customer records. The employee who stole trade secrets to get a leg up in his next job because hey, after all, it’s “his” work that he’s taking, right? Those are our traditional notions of insider risk and...

Ubuntu 18.04 LTS / 20.04 LTS : ImageMagick vulnerabilities (USN-4988-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4988-1 advisory. It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were...