New insights on cybersecurity in the age of hybrid work

As we approach the last week of Cybersecurity Awareness Month, I think about what is top of mind for myself and my peers in security. The past year has continued the 2020s major shift in the way organizations operate. Recent data shows that 81 percent of enterprise organizations have begun the mo...

The vulnerability of the iFrameSandbox component in the Google Chrome web browser, related to improper authorization, allows a malicious actor to compromise data integrity.

The vulnerability of the iFrameSandbox component in the Google Chrome web browser is related to insufficient implementation of policies. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

openSUSE 15 Security Update : chromium (openSUSE-SU-2021:1392-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1392-1 advisory. - : Heap buffer overflow in Skia. CVE-2021-37981 - : Use after free in Incognito. CVE-2021-37982 - : Use after free in Dev Tools...

CVE-2021-41173

CVE-2021-41173 affects go-ethereum prior to v1.10.9, where processing a malicious snap/1 message could crash a node (DoS). The Red Hat and OSV details corroborate a crash in Go Ethereum’s P2P handling, specifically the GetTrieNodes path in the snap protocol. The root cause involved unsafe handlin...

OPENSUSE-SU-2021:1392-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 95.0.4638.54 boo1191844: CVE-2021-37981: Heap buffer overflow in Skia CVE-2021-37982: Use after free in Incognito CVE-2021-37983: Use after free in Dev Tools CVE-2021-37984: Heap buffer overflow in PDFium CVE-2021-37985: Use after free...

Facebook HHVM 路径遍历漏洞

Facebook HHVM a.k.a. HipHop Virtual Machine is a virtual machine from Facebook Inc. that significantly improves the performance of loading dynamic pages in PHP. HHVM suffers from a path traversal vulnerability that stems from improper design or implementation during code development of a networke...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2021:1392-1 Rating: important References: 1191844 Cross-References: CVE-2021-37981 CVE-2021-37982 CVE-2021-37983 CVE-2021-37984 CVE-2021-37985 CVE-2021-37986 CVE-2021-37987 CVE-2021-37988 CVE-2021-37989...

Online Course Registration 1.0 - Blind Boolean-Based SQL Injection Exploit

Exploit Title: Online Course Registration 1.0 - Blind Boolean-Based SQL Injection Authenticated Exploit Author: Sam Ferguson @AffineSecurity and Drew Jones @qhum7sec Vendor Homepage: https://www.sourcecodester.com/php/14251/online-course-registration.html Software Link:...

Chromium: CVE-2021-37990 Inappropriate implementation in WebView

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Ubuntu: Security Advisory (USN-5116-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Alfresco 代码问题漏洞

Alfresco is an open source enterprise content management system. The platform pages are developed using Freemarker, and the main features include document management, collaboration, records management, knowledge base management, Web content management, etc. Alfresco has a security vulnerability...

Google Chrome Blink improperly implemented vulnerability (CNVD-2021-84806)

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to an improper Blink implementation. An attacker could exploit this vulnerability to abuse content security policies via crafted HTML pages...

Google Chrome WebApp Installer improperly implemented vulnerability

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to an improper implementation of WebApp Installer. An attacker could potentially override and spoof the content of the multi-function box URL bar via a crafted HTML page...

Denial Of Service (DoS)

qt5-qtwebengine is vulnerable to denial of service. The vulnerability exists due to an Inappropriate implementation in Sandbox...

Wrong implementation of CreditLimitByMedian.sol#getLockedAmount() will lock a much bigger total amount of staked tokens than expected

Handle WatchPug Vulnerability details function getLockedAmount LockedInfo memory array, address account, uint256 amount, bool isIncrease public pure override returns uint256 if array.length == 0 return 0; uint256 newLockedAmount; if isIncrease for uint256 i = 0; i arrayi.lockedAmount...

Modern-Async 资源管理错误漏洞

Modern-Async is a modern JavaScript tool library for asynchronous operations using Async/Await and Promise. A resource management error vulnerability exists in modern-async that arises from improper design or implementation during code development for a networked system or product...

CVE-2021-41131

python-tuf is a Python reference implementation of The Update Framework TUF. In both clients tuf/client and tuf/ngclient, there is a path traversal vulnerability that in the worst case can overwrite files ending in .json anywhere on the client system on a call to getonevalidtargetinfo. It occurs...

Path traversal

python-tuf is a Python reference implementation of The Update Framework TUF. In both clients tuf/client and tuf/ngclient, there is a path traversal vulnerability that in the worst case can overwrite files ending in .json anywhere on the client system on a call to getonevalidtargetinfo. It occurs...

CVE-2021-41131 Client metadata path-traversal in python-tuf

python-tuf is a Python reference implementation of The Update Framework TUF. In both clients tuf/client and tuf/ngclient, there is a path traversal vulnerability that in the worst case can overwrite files ending in .json anywhere on the client system on a call to getonevalidtargetinfo. It occurs...

chromium -- multiple vulnerabilities

Chrome Releases reports: This release contains 19 security fixes, including: 1246631 High CVE-2021-37981: Heap buffer overflow in Skia. Reported by Yangkang @dnpushme of 360 ATA on 2021-09-04 1248661 High CVE-2021-37982: Use after free in Incognito. Reported by Weipeng Jiang @Krace from Codesafe...