CVE-2021-29294

Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK1.01, which could let a remove malicious user cause a denial of service via the sendhnapunauthorized function. It could be triggered by sending crafted POST request to /HNAP1/. NOTE: The DSL-2740R and all hardware revisions are...

CVE-2021-29295

Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. It could be triggered by sending an HTTP request without URL in the start line directly to the device. NOTE: The DSP-W215 and all hardware...

CVE-2021-29296

D-Link DIR-825, firmware 2.10b02 (Rev B or earlier), contains a NULL pointer dereference in the web server when handling requests to /vct_wan (or /vct wan), leading to a segmentation fault and remote denial of service. OpenVAS notes this as a NULL pointer dereference affecting DIR-825 Rev B

CVE-2021-29296

Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vulnerability could be triggered by sending an HTTP request with URL /vctwan; the sbin/httpd would invoke the strchr function and take NULL as a first argument,...

CVE-2021-29295

Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via usr/bin/lighttpd. It could be triggered by sending an HTTP request without URL in the start line directly to the device. NOTE: The DSP-W215 and all hardware...

CVE-2021-29295

The CVE-2021-29295 vulnerability affects D-Link DSP-W215 (version 1.10). A null pointer dereference in the device’s HTTP handling (via usr/bin/lighttpd) can be exploited remotely by sending an HTTP request with no URL in the start line, enabling denial of service. Multiple sources corroborate the...

CVE-2021-29294

Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK1.01, which could let a remove malicious user cause a denial of service via the sendhnapunauthorized function. It could be triggered by sending crafted POST request to /HNAP1/. NOTE: The DSL-2740R and all hardware revisions are...

golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader

An infinite loop vulnerability was found in golang. If an application defines a custom token parser initializing with xml.NewTokenDecoder it is possible for the parsing loop to never return. An attacker could potentially craft a malicious XML document which has an XML element with EOF within it,...

Some versions of Windows 10 display a notification to install the latest version

None None...

Apple Adds a Backdoor to iMessage and iCloud Storage

Apples announcement that its going to start scanning photos for child abuse material is a big deal. Here are five news stories. I have been following the details, and discussing it in several different email lists. I dont have time right now to delve into the details, but wanted to post something...

rust: heap-based buffer overflow in read_to_end() because it does not validate the return value from Read in an unsafe context

In the standard library in Rust before 1.50.0, readtoend does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow...

PT-2021-18161 · D Link · D-Link Dsl-2740E

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2740R version UK 1.01 Description: A Null Pointer Dereference issue exists, which could allow a remote malicious user to cause a denial of service via the send hnap unauthorized function. This can be triggered by sending a crafted...

PT-2021-18163 · D Link · D-Link Dir-825

Name of the Vulnerable Software and Affected Versions: D-Link DIR-825 version 2.10b02 Description: The issue is a Null Pointer Dereference vulnerability that could allow a remote malicious user to cause a denial of service. This can be triggered by sending an HTTP request with the URL /vct wan,...

KB5005112: Servicing stack update for Windows 10, version 1809: August 10, 2021

None None...

PT-2021-18162 · D Link · D-Link Dsp-W215

Name of the Vulnerable Software and Affected Versions: D-Link DSP-W215 version 1.10 Description: A Null Pointer Dereference issue exists, which could allow a remote malicious user to cause a denial of service via usr/bin/lighttpd. This can be triggered by sending an HTTP request without a URL in...

GHSA-H563-XH25-X54Q Workflow re-write vulnerability using input parameter

Impact Allow end-users to set input parameters, but otherwise expect workflows to be secure. Patches Not yet. Workarounds Set EXPRESSIONTEMPLATES=false for the workflow controller References https://github.com/argoproj/argo-workflows/issues/6441 For more information If you have any questions or...

Workflow re-write vulnerability using input parameter

Impact Allow end-users to set input parameters, but otherwise expect workflows to be secure. Patches Not yet. Workarounds Set EXPRESSIONTEMPLATES=false for the workflow controller References https://github.com/argoproj/argo-workflows/issues/6441 For more information If you have any questions or...

Users Can Be Just As Dangerous As Hackers

Among the problems stemming from our systemic failure with cybersecurity, which ranges from decades-old software-development practices to Chinese and Russian cyber-attacks, one problem gets far less attention than it should—the insider threat. But the reality is that most organizations should be ...

Zoom Settlement: An $85M Business Case for Security Investment

Ransomware isn’t the only way lax security can cost a business eight figures in damage. Zoom just lost an $85 million class-action lawsuit this week for its cybersecurity missteps, proving that even the most essential and relied-upon brands can be tripped up by inadequate security. More...

CVE-2021-37556

A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated but low-privileged attackers to execute arbitrary SQL commands via the include/reporting/dashboard/csvExport/csvHostGroupLogs.php start and end parameters...