CVE-2021-22873

Revive Adserver before 5.1.0 is vulnerable to open redirects via the dest, oadest, and/or ct0 parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third...

Stacking CDNs for Improved Performance and Security

I recently worked with a client whose large e-commerce site was hosted with a popular cloud-based commerce solution. Its business was growing rapidly into new geographic markets, and it was not satisfied with the embedded content delivery network eCDN that was bundled with the cloud solution. We...

Stacking CDNs for Improved Performance and Security

I recently worked with a client whose large e-commerce site was hosted with a popular cloud-based commerce solution. Its business was growing rapidly into new geographic markets, and it was not satisfied with the embedded content delivery network eCDN that was bundled with the cloud solution. We...

VulnCheck KEV: CVE-2020-8269

An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9...

VulnCheck KEV: CVE-2020-8270

An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342...

Phishing Campaign Leverages WOFF Obfuscation and Telegram Channels for Communication

FireEye Email Security recently encountered various phishing campaigns, mostly in the Americas and Europe, using source code obfuscation with compromised or bad domains. These domains were masquerading as authentic websites and stole personal information such as credit card data. The stolen...

UBUNTU-CVE-2021-23953

If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data. This vulnerability affects Firefox 85, Thunderbird 78.7, and Firefox ESR 78.7...

Revive Adserver 跨站脚本漏洞

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver versions prior to 5.1.0, which stems from publi...

Weak Password Vulnerability in WiseGrid WiseGrid Application Delivery Gateway

The business scope of Beijing Sino-Red Software System Co., Ltd. includes: software development; computer system service; technology promotion service; technology development of network equipment, communication products, computer hardware and software, etc. A weak password vulnerability exists in...

Dovecot 2.3.11 - 2.3.11.3 DoS Vulnerability

Dovecot is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dovecot:dovecot";...

DLL Hijacking Vulnerability in Meituan Takeout Merchant Edition PC Client

Meituan Delivery Merchant Edition is a background management software provided by Meituan Delivery for merchants who have joined Meituan Delivery, which can help merchants manage the information of their income and expenditure orders well. A DLL hijacking vulnerability exists in the PC client of...

OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-03040)

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability via a specially crafted Content-Disposition header ...

Open-xchange OX App Suite 跨站脚本漏洞

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability via a specially crafted Content-Disposition header ...

FreeBSD : mail/dovecot -- multiple vulnerabilities (bd98066d-4ea4-11eb-b412-e86a64caca56)

Aki Tuomi reports : When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server. Mail delivery / parsing crashed when t...

It’s Not the Trump Sex Tape, It’s a RAT

As outgoing President Donald Trump continues to dominate headlines, cybercriminals have decided to horn in on the much-gossiped-about — and yet to materialize — Trump sex tape as a lure for malware delivery. A campaign has been uncovered that labels a malware downloader with the filename...

Shifting Security Right: How Cloud-Based SecOps Can Speed Processes While Maintaining Integrity

When it comes to offloading security controls to the cloud, it may seem counterintuitive to the notion of “securing” things. But, when we consider the efficiency to be gained by shifting right with some security controls, it makes sense to send more granular, ground-up responsibilities to a trust...

Updated minidlna packages fix security vulnerabilities

It was discovered that minidlna does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue CVE-2020-12695. Minidlna before versions 1.3.0 allows remote code execution...

Attackers Abusing Citrix NetScaler Devices to Launch Amplified DDoS Attacks

Citrix has issued an emergency advisory warning its customers of a security issue affecting its NetScaler application delivery controller ADC devices that attackers are abusing to launch amplified distributed denial-of-service DDoS attacks against several targets. "An attacker or bots can overwhe...

iPhones of 36 Al Jazeera journalists hacked with NSO’s zero-click spyware

By Deeba Ahmed Citizen Lab researchers claim the spyware was delivered silently through iMessage. This is a post from HackRead.com Read the original post: iPhones of 36 Al Jazeera journalists hacked with NSOs zero-click spyware...

Smart DNS for the New Network: Optimizing Content Delivery

This is the third in a series of blog posts that will discuss how smart DNS resolvers can enhance ongoing internet service provider ISP and mobile network operator MNO network transformation efforts, such as the transition to 5G, better integration of Wi-Fi, and new network designs that optimize...