5354 matches found
CVE-2020-17504
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters...
Important: thunderbird
Issue Overview: When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a variable amount of time depending on the content of the underlying image. This resulted in potential cross-origin information exposure of image content through timi...
UBUNTU-CVE-2021-21235
kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::readfromcontainer can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround i...
PT-2021-14347 · Unknown · Kamadak-Exif
Name of the Vulnerable Software and Affected Versions: kamadak-exif version 0.5.2 Description: The issue is related to an infinite loop in parsing crafted PNG files, specifically in the reader::read from container function. This can lead to a denial-of-service DoS condition when used with untrust...
2021 Cybersecurity Trends: Bigger Budgets, Endpoint Emphasis and Cloud
After shrinking in 2020, cybersecurity budgets in 2021 climb higher than pre-pandemic limits. Authentication, cloud data protection and application monitoring will top the list of CISO budget and cybersecurity priorities. According to experts, these are just a few of the themes to dominate the ye...
The strangest cybersecurity events of 2020: a look back
This year is finally coming to an end, and it only took us about eight consecutive months of March to get here. There is a ton to talk about, and that’s without even discussing the literal global pandemic. You see, 2020s news stories were the pressure-cooker product of mania, chaos, and the...
CVE-2020-35917
An issue was discovered in the pyo3 crate before 0.12.4 for Rust. There is a reference-counting error and use-after-free in From...
Rust Security Vulnerabilities
Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability exists in Rust multihash crate before 0.11.3, which stems from from slice parsing code that could cause a panic via unsanitized data from a web server...
Most-Wanted Threatpost Stories of 2020
As 2020 draws to a close, it’s clear that work-from-home security, ransomware, COVID-19-themed social engineering and attacks by nation-states will go down as defining topics for the cybersecurity world for the year. Threatpost also took a retrospective view on what readers were most interested...
CVE-2020-25847
creationtimestamp| type| source ---|---|--- 2020-12-29 12:29:24+00:00| seen| https://t.me/cibsecurity/21376...
CVE-2020-7845
Spamsniper 5.0 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command. It leads remote attacker to execute arbitrary code via crafted packet...
How to Defend Against Malware, Phishing, and Scams During COVID-19 Crisis
As if the exponential rise in phishing scams and malware attacks in the last five years wasn't enough, the COVID-19 crisis has worsened it further. The current scenario has given a viable opportunity to cybercriminals to find a way to target individuals, small and large enterprises, government...
spring-batch: XML External Entity Injection (XXE) when receiving XML data from untrusted sources
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection XXE when receiving XML data from untrusted sources...
SUSE SLES15 Security Update : kernel (SUSE-SU-2020:3764-1)
The SUSE Linux Enterprise 15 SP2 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed : CVE-2020-15436: Fixed a use after free vulnerability in fs/blockdev.c which could have allowed local users to gain privileges or cause a denial of service...
Cyber Monday is Every Monday: Securing the 'New Normal'
Derek Manky Though eCommerce threats are usually only top-of-mind during the holiday shopping season, researchers have been on high alert when it comes to cybercriminal activity in the retail space during all of 2020, due to troves of new shoppers and stores going online. That’s according to Dere...
The story of the year: remote work
The coronavirus pandemic has caused sudden, sweeping change around the world. The necessary social distancing measures are having an impact on all of us. One large part of society that has been affected by these measures more than others is the employed. While direct customer facing businesses li...
D-Link Routers at Risk for Remote Takeover from Zero-Day Flaw
Buggy firmware opens a number of D-Link VPN router models to zero-day attacks. The flaws, which lack a complete vendor fix, allow adversaries to launch root command injection attacks that can be executed remotely and allow for device takeover. Impacted are D-Link router models DSR-150, DSR-250,...
PT-2020-7011 · Gnu +5 · Gsl +5
Name of the Vulnerable Software and Affected Versions: GSL GNU Scientific Library versions 2.5 and 2.6 Description: A buffer overflow can occur when calculating the quantile value using the Statistics Library of GSL. Processing a maliciously crafted input data for gsl stats quantile from sorted...
php: Files added to tar with Phar::buildFromIterator have all-access permissions
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator function, the files are added with default permissions 0666, or all access even if the original files on the filesystem were with more restrictive permissions...