CVE-2021-21431

The CVE-2021-21431 entry affects the sopel-channelmgnt plugin for Sopel. In versions prior to 2.0.1, on some IRC servers, the ability to remove the bot via kick/kickban could be bypassed when kicking multiple users at once. There is also a belief that removing users from other channels might have...

Alert — There's A New Malware Out There Snatching Users' Passwords

A previously undocumented malware downloader has been spotted in the wild in phishing attacks to deploy credential stealers and other malicious payloads. Dubbed "Saint Bot," the malware is said to have first appeared on the scene in January 2021, with indications that it's under active developmen...

PT-2021-14503 · Unknown · Sopel-Channelmgnt

Name of the Vulnerable Software and Affected Versions: sopel-channelmgnt versions prior to 2.0.1 Description: The issue concerns the sopel-channelmgnt plugin for sopel, where restrictions around the removal of the bot using the kick/kickban command could be bypassed on some IRC servers when kicki...

A deep dive into Saint Bot, a new downloader

This post was authored by Hasherezade with contributions from Hossein Jazi and Erika Noerenberg In late March 2021, Malwarebytes analysts discovered a phishing email with an attached zip file containing unfamiliar malware. Contained within the zip file was a PowerShell script masquerading as a li...

PYSEC-2021-111

projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...

Web Application Firewalls Instrumental in Digital-First Banking

Like many industries, the banking and insurance sectors have shifted their resources to be digital-first, all the more so since the start of the global pandemic. For today’s customers, who increasingly begin their banking experiences using digital channels, whether online or mobile, a digital-fir...

Authentication Bypass

microsoft.bot.connector is vulnerable to authentication bypass. An attacker is able to bypass authentication using a malicious claim that is incorrectly authenticated by the bot. The vulnerability affects bots that are not configured to be used as a Skill and requires an an attacker to have...

botframework-connector vulnerable to Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see the...

GHSA-CQFF-FX2X-P86V botframework-connector vulnerable to Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see the...

Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see t...

GHSA-QXX8-292G-2W66 Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see t...

botframework-connector vulnerable to Improper Authentication

Impact A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot. Patches The problem has been patched in all affected versions. Please see the...

Bad Bot Traffic on Healthcare Websites Rises 372% As Vaccines Become Available Globally

Nations around the world are racing to acquire COVID-19 vaccines and assemble digital infrastructure and web applications to enable appointment booking. As they do this, Imperva Research Labs has monitored a staggering 372% increase in bad bot traffic on healthcare websites globally since Septemb...

Akamai Identified as a Leader in DDoS Mitigation by Forrester

This week, Akamai was again recognized as a Leader in the latest The Forrester Wave™: DDoS Mitigation Solutions, Q1 2021. Akamai has also been recognized by Forrester as a Leader in its most recent The Forrester Wave™: Zero Trust eXtended Ecosystem Platform Providers, Q3 2020, The Forrester New...

Yeezy Fans Face Sneaker-Bot Armies for Hot Kicks Releases

Shopping bots are likely to make it tough for everyday sneakerheads to get their hands on a pair of new Adidas Yeezy shoes from Kanye West as more styles become available through retailers in the next few months. Researchers at Cequence Security track bots across the internet, and the company’s...

@ioup/mia-bot (=0.0.1) potentially affected by CVE-2021-23378 via picotts (=0.1.1)

picotts NPM version =0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on picotts and may be impacted: - @ioup/mia-bot =0.0.1 Source cves: CVE-2021-23378 Source advisory: SNYK:JS-PICOTTS-1078539...

Questions to Ask Your Application Security Provider

There is a great deal to consider when evaluating application security providers. Understanding your goals will help. If your goal is vendor consolidation, then selecting those that offer multiple security capabilities over single products may make more sense. And if your goal is out-of-the-box...

CVE-2021-22984

On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM...

CVE-2021-22984

CVE-2021-22984 affects F5 BIG-IP ASM/Advanced WAF Bot Defense open redirection. Affected: BIG-IP with Bot Defense or DoS profiles may redirect unauthenticated requests to a malicious URI, producing HTTP 307 redirects. Impact: potential phishing or credential theft through unexpected redirects. Af...

CVE-2021-22984

On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM...