1039 matches found
CVE-2022-24666
A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS fram...
Ransomware attack on Swissport aviation firm causes flight delays
By Deeba Ahmed Swissport claims it "contained an IT security incident" referring to a ransomware attack that took place on February… This is a post from HackRead.com Read the original post: Ransomware attack on Swissport aviation firm causes flight delays...
Signiant flight 代码问题漏洞
Signiant flight is a unique utility from Signiant USA for optimizing the transfer of large data sets to and from the cloud. A security vulnerability in Manager+Agents before Signiant flight deck 15.1 allows XML External Entity XXE attacks...
RLSA-2022:0307 Moderate: java-1.8.0-openjdk security and bug fix update
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. Security Fixes: OpenJDK: Incomplete deserialization class filtering in ObjectInputStream Serialization, 8264934 CVE-2022-21248 OpenJDK: Insufficient URI checks in the XS...
java-1.8.0-openjdk security and bug fix update
An update is available for java-1.8.0-openjdk. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime...
Commercial Air Transport EFB Regulation
Introduction The Electronic Flight Bag EFB is a device pilots use to gather information. This includes viewing airport charts ground and in-flight, calculating take-off and landing performance, as well as multiple other uses as detailed in our other EFB blog posts. EFB regulation is, in a word,...
EFB Tampering. The Human Factor
Like most people, pilots want to expedite things and generally make their work easier. A common conception about aviation is that its a leading industry with technology at its forefront. While this is generally true some of the systems in use today are rather dated to put it mildly. A great examp...
arrow (>=0.14.0, <=4.4.0), arrow-flight (>=2.0.0, <=4.4.0) +62 more potentially affected by CVE-2020-35864 via flatbuffers (>=0.4.0, <=0.8.4)
flatbuffers CARGO version =0.4.0, =0.14.0, =2.0.0, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.17.0, =0.1.1, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2020-35864 Source advisory: OSV:GHSA-C9H5-HF8R-M97X...
flightcentre.co.uk Cross Site Scripting vulnerability OBB-2124412
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Ransomware. In the air?
Introduction As an exercise, we were asked to look at the potential vectors for ransomware to affect flight despatch and operations. In most cases, flight systems simply werent significantly exposed, but ground systems affected by ransomware may make flight ops either impossible or significantly...
qemu security update
15:4.2.1-10.el7 - e1000: fail early for evil descriptor Jason Wang Orabug: 32560552 CVE-2021-20257 - Document CVE-2020-27661 as fixed Mark Kanda Orabug: 32960200 CVE-2020-27661 - block: Avoid stale pointer dereference in blkgetaiocontext Greg Kurz - block: Fix blk-inflight during...
Why hackers don’t fly coach
Physical security is relied on too heavily for cabin-based systems on the Airline Information Services Domain AISD. Whilst the Aircraft Control Domain ACD is separated, there are still plenty of interesting information, data and systems that are accessible from the cabin, for those who are prepar...
Deploying EFBs securely
It may come as a surprise to some to discover that electronic flight bag security at airlines is often quite variable. Whilst some use an MDM, a lot don’t. Of those who do, PINs are often weak. Some airlines actively encourage pilots to use their devices for personal use. We’ve heard stories of a...
Getting a persistent shell on a 747 IFE
TL:DR The Coronavirus pandemic has hit the airline industry hard. One sad consequence was early retirement of most of the 747 passenger fleet. This does however create opportunities for aviation security research, as airframes are parked up before parting out in breakers yards. This 747 was flyin...
EFB Tampering 3. Take-off pt1
Take-off Performance Part 1: Introduction, Thrust & Speeds TL;DR Take-off performance applications perform calculations to provide critical take-off performance data to pilots e.g. thrust/trim/flap setting for take-off Modifying any one of these could have severe consequences. For example, an...
EFB Safety Advice for Pilots
As a pilot you will be all too aware of how important an electronic flight bag EFB is to you and your role. It’s probably critical to your takeoff performance calculations, your roster, pax lists and plenty more. It’s one thing if its not working, but have you ever stopped to consider what could...
EFB Tampering 1. Introduction and Class Differences
TL;DR Electronic flight bags EFBs are devices that flight crews use to help with flight management tasks Different airlines use different devices e.g. iPads, netbooks, custom devices Some are carried on by flight crew, others are built-in to the cockpit Some important functions are carried out by...
Code42 Incydr Series: Honing in on high-risk users with Code42 Incydr
The crux of the insider threat challenge is that everyone can be a risk. That’s why most security teams are focusing on gaining broader and deeper visibility into all file activity — especially the surge in remote, off-network activity. But this doesn’t mean that security teams should discount...
DDoS attacks in Q3 2020
News overview Q3 was relatively calm from a DDoS perspective. There were no headline innovations, although cybercriminals did continue to master techniques and develop malware already familiar to us from the last reporting period. For example, another DDoS botnet joined in the assault on Docker...
Two major flight tracking services hit by crippling cyberattacks
By Waqas It is still unclear who is behind these cyberattacks however both Flightradar24 and PlaneFinder suffered major service disruption after the attacks. This is a post from HackRead.com Read the original post: Two major flight tracking services hit by crippling cyberattacks...