openSUSE 15 Security Update : transfig (openSUSE-SU-2021:1481-1)

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1481-1 advisory. - fig2dev 3.2.7b contains a stack buffer overflow in the bezierspline function in genepic.c. CVE-2020-21529 - fig2dev 3.2.7b contains a...

Exchange, Fortinet Flaws Being Exploited by Iranian APT, CISA Warns

A state-backed Iranian threat actor has been using multiple CVEs – including both serious Fortinet vulnerabilities for months and a Microsoft Exchange ProxyShell weakness for weeks – looking to gain a foothold within networks before moving laterally and launching BitLocker ransomware and other...

NEX-Forms <= 7.9.4 - Multiple Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings and form fields before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. In Global Setting Preferences Validation, put the following...

CVE-2021-3720

An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro L79031 and Legion Phone2 Pro L70081 that could allow other applications to access device GPS data...

How to Securely Access Remote Desktop?

By Owais Sultan Since remote desktop access allows a device to be accessed from anywhere globally over the public internet, security is an important consideration. This is a post from HackRead.com Read the original post: How to Securely Access Remote Desktop?...

OSV-2021-1563 Global-buffer-overflow in xstrdup

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40915 Crash type: Global-buffer-overflow READ 1 Crash state: xstrdup scanfilteredsymbols scanallsymbols...

Motorola-branded Binatone Hubble Cameras 安全漏洞

The Binatone Global Binatone Motorola-branded Camera is a Binatone licensed and manufactured Motorola-branded product camera from Binatone Global. A security vulnerability exists in the Motorola-branded Binatone Hubble Cameras, which can be exploited by attackers to gain unauthorized access to th...

CentOS 8 : openjpeg2 (CESA-2021:4251)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4251 advisory. - openjpeg: division-by-zero in functions pinextpcrl, pinextcprl, and pinextrpcl in openmj2/pi.c CVE-2018-20845 - openjpeg: integer overflow in functio...

RHEL 8 : openjpeg2 (RHSA-2021:4251)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4251 advisory. OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages have been upgraded to a...

Vestings' revoke status can be set by anyone

Handle cmichel Vulnerability details The idea of revoking vesting supposedly exists for the admins to call Vesting.revoke and claim back a user's vesting. However, if the user wants to protect their vesting from being revoked by the admin, they can create a new vest with isRevocable = false and a...

_isRevocable is tied to the address and can be set by anyone

Handle pauliax Vulnerability details Impact function vest has a parameter isRevocable that is tied to the account address of beneficiary. because anyone can call vest, it allows overriding benRevocable as many times as you want. I see several potential problems with this: 1. isRevocable sets glob...

Void Balaur and the Rise of the Cybermercenary Industry

One of the most prolific cybermercenaries is Void Balaur, a Russian-speaking threat actor group that has launched attacks against different sectors and industries all over the world...

Suspected REvil Ransomware Affiliates Arrested in Global Takedown

Romanian law enforcement authorities have announced the arrest of two individuals for their roles as affiliates of the REvil ransomware family, dealing a severe blow to one of the most prolific cybercrime gangs in history. The suspects are believed to have orchestrated more than 5,000 ransomware...

Zoho’s ManagedEnginePassword Manager Flaw Torched by Godzilla Webshell, New Data Stealer

A new campaign is prying apart a known security vulnerability in the Zoho ManageEngine ADSelfService Plus password manager, researchers warned over the weekend. The threat actors have managed to exploit the Zoho weakness in at least nine global entities across critical sectors so far technology,...

Security update for transfig (important)

openSUSE Security Update: Security update for transfig Announcement ID: openSUSE-SU-2021:1458-1 Rating: important References: 1189325 1189343 1189345 1189346 1190607 1190611 1190612 1190615 1190616 1190617 1190618 1192019 Cross-References: CVE-2020-21529 CVE-2020-21530 CVE-2020-21531 CVE-2020-215...

Ignore China’s New Data Privacy Law at Your Peril

The Personal Information Protection Law gives authorities the power to impose huge fines and blacklist companies. But the biggest impact may be felt outside the country...

global-pay.com.au Improper Access Control vulnerability OBB-2232128

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-43032

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side...

CVE-2021-43032

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side...

Holiday Shopping Season is Upon Us: The State of Security Within eCommerce in 2021

The eCommerce industry has gone through years worth of changes in a matter of just a mere couple of months as the global pandemic emerged back in March of 2020. These changes have led to skyrocketing growth for the industry, with sales predicted to hit $4.921 trillion by the end of this year. And...