KLA12548 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. Inappropriate implementation vulnerability in...

UBUNTU-CVE-2022-21499

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7...

The Justice Department Will No Longer Charge Security Researchers with Criminal Hacking

Following a recent Supreme Court ruling, the Justice Department will no longer prosecute "good faith" security researchers with cybercrimes: The policy for the first time directs that good-faith security research should not be charged. Good faith security research means accessing a computer solel...

Get to Know Patrick Flynn

Meet Patrick Flynn Head of Advanced Programs Group at Trellix Threat Labs By Trellix · May 24, 2022 This blog was written by Michael Alicea At Trellix, we celebrate and champion our people. This week, I sat down with Pat Flynn, Head of Advanced Programs Group for Trellix Threat Labs. His job is a...

PT-2022-3149

Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 102.0.5005.61 Microsoft Edge affected versions not specified Description The issue is related to insufficient policy enforcement in the Safe Browsing service, which can be exploited by a remote attacker t...

PT-2022-3144

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 102.0.5005.61 Microsoft Edge affected versions not specified Description The issue is related to insufficient policy enforcement in the File System API of Google Chrome and Microsoft Edge browsers. This can be...

PT-2022-3147

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 102.0.5005.61 Microsoft Edge affected versions not specified Description The issue is related to insufficient policy enforcement in the Extensions API of Google Chrome and Microsoft Edge browsers. This can be...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome versions 70.0.3538.67 through 101.0.4951.67, which stems from insufficient policy enforcement in the file system API. A remote attacker can exploit the vulnerability to bypass implemented security...

Google Chrome security vulnerabilities

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome versions 70.0.3538.67 through 101.0.4951.67 that stems from insufficient policy enforcement in secure browsing. A remote attacker could exploit the vulnerability to bypass the implemented security...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 32 security fixes, including: 1324864 Critical CVE-2022-1853: Use after free in Indexed DB. Reported by Anonymous on 2022-05-12 1320024 High CVE-2022-1854: Use after free in ANGLE. Reported by SeongHwan Park SeHwa on 2022-04-27 1228661 High...

Weak Password Policy

Description I would like to let you know about the password management issue. Proof of Concept 1- Go to your Profile or https://demo-publify.herokuapp.com 2- Give a password as simple as 12345678. You can see you will be password has been changed and there is no strong enforcement...

CVE-2021-21185

Insufficient policy enforcement in extensions in Google Chrome prior to 89.0.4389.72 allowed an attacker who convinced a user to install a malicious extension to obtain sensitive information via a crafted Chrome Extension...

CVE-2021-21131

Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page...

Weak Password Policy

Description I would like to let you know about the password management issue. Proof of Concept 1- Go to your Profile or https://docker.trudesk.io/profile 2- Give a password as simple as 12345678. You can see you will be password has been changed and there is no strong enforcement...

MoinMoin Access Restrictions Bypassed due to improper ACL enforcement

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when aclhierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937...

GHSA-WC8W-GH5M-62FV MoinMoin Access Restrictions Bypassed due to improper ACL enforcement

MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when aclhierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937...

DEA Investigating Breach of Law Enforcement Data Portal

The U.S. Drug Enforcement Administration DEA says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment...

fetchmail: STARTTLS session encryption bypassing

Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH...

CVE-2022-1053

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

Validation Bypass

keylime is vulnerable to validation bypass. The vulnerability is caused due to lack of enforcement of same registrar data for tenant and verifier validation of the EK, AK and identity and integrity quotes, allowing to break the chain of trust as it can use invalid AK as valid...