Benefits of Building a Multi-prong Mousetrap for WAF Policies with ML

The reason behind buying a market-leading Web Application Firewall WAF is to protect your website and web applications from malicious attacks, plus complying with industry or regional data and privacy standards. In addition to the typical OWASP Top 10 vulnerabilities, WAFs need to address a litan...

Microsoft Warns of 25 Critical Vulnerabilities in IoT, Industrial Devices

Security researchers at Microsoft are warning the industry about 25 as-yet undocumented critical memory-allocation vulnerabilities across a number of vendors’ IoT and industrial devices that threat actors could exploit to execute malicious code across a network or cause an entire system to crash...

Hurricane CMS 1.1.0 file upload vulnerabilities in the background

Hurricane CMS is an open source CMS system, characterized by all open source, efficient and convenient secondary development, simple background, plug-ins categorized in detail, adapted to various types of websites to expand the construction. Hurricane CMS1.1.0 file upload vulnerability exists in...

CVE-2021-31428

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.5-47309. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists withi...

DEBIAN-CVE-2021-25214

In BIND 9.8.5 - 9.8.8, 9.9.3 - 9.11.29, 9.12.0 - 9.16.13, and versions BIND 9.9.3-S1 - 9.11.29-S1 and 9.16.8-S1 - 9.16.13-S1 of BIND 9 Supported Preview Edition, as well as release versions 9.17.0 - 9.17.11 of the BIND 9.17 development branch, when a vulnerable version of named receives a malform...

Moderate: Red Hat Security Advisory: OpenJDK 11.0.11 Security Update for Portable Linux Builds

The Red Hat Build of OpenJDK 11 java-11-openjdk is now available for portable Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: OpenJDK 8u292 Security Update for Portable Linux Builds

The Red Hat Build of OpenJDK 8 java-1.8.0-openjdk is now available for portable Linux. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Enhancement Advisory: rh-eclipse bug fix and enhancement update

Updated rh-eclipse packages are now available as a part of Red Hat Developer Tools for Red Hat Enterprise Linux. Eclipse is an integrated development environment IDE. The rh-eclipse packages have been upgraded to version 4.19, which is based on the Eclipse Foundation's 2021-03 release train. For...

Renqiu Zhengzhong Network Technology Co., Ltd. website building system has SQL injection vulnerabilities (CNVD-2021-34201)

Renqiu Zhengzhong Network Technology Co., Ltd. business scope includes: network technology services, software development and so on. Renqiu Zhengzhong Network Technology Co., Ltd. station building system there is a SQL injection vulnerability, the attacker can use the vulnerability to obtain...

Renqiu Zhengzhong Network Technology Co., Ltd. website building system has SQL injection vulnerabilities (CNVD-2021-34208)

Renqiu Zhengzhong Network Technology Co., Ltd. business scope includes: network technology services, software development and so on. Renqiu Zhengzhong Network Technology Co., Ltd. station building system there is a SQL injection vulnerability, the attacker can use the vulnerability to obtain...

The vulnerability of the Remote Development Extension Pack, a plugin for the Microsoft Visual Studio Code editor, allows a hacker to execute arbitrary code.

The vulnerability of the Remote Development Extension Pack, a development extension for the Microsoft Visual Studio Code editor, is related to improper code generation management. Exploiting this vulnerability could allow an attacker to execute arbitrary code by sending a specially crafted reques...

CVE-2021-31784

An out-of-bounds write vulnerability exists in the file-reading procedure in Open Design Alliance Drawings SDK before 2021.6 on all supported by ODA platforms in static configuration. This can allow attackers to cause a crash, potentially enabling a denial of service attack Crash, Exit, or Restar...

CISA and NIST Release New Interagency Resource: Defending Against Software Supply Chain Attacks

A software supply chain attack—such as the recent SolarWinds Orion attack—occurs when a cyber threat actor infiltrates a software vendor’s network and employs malicious code to compromise the software before the vendor sends it to their customers. The compromised software can then further...

Posta - Cross-document Messaging Security Research Tool

Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js option...

CVE-2020-36321

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder...

CVE-2020-36321

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder...

Pegasystem PEGA Platform Access Control Error Vulnerability (CNVD-2021-30581)

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. An access control error vulnerability...

Exploit for Improper Input Validation in Microsoft

Weaponized CVE-2019-0604 Automated Exploit Tool to Maximize C...

File Upload Vulnerability in Library Cluster Management System of Guangzhou Tutron Computer Software Development Co. Ltd (CNVD-2021-32386)

Guangzhou Tutron Computer Software Development Co., Ltd. is a high-tech enterprise integrating product development, application integration and customer service. A file upload vulnerability exists in the Library Cluster Management System of Guangzhou Tutron Computer Software Development Co. An...

Moderate: Red Hat Security Advisory: java-1.8.0-openjdk security update

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...