SUSE: Security Advisory (SUSE-SU-2019:3316-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Codecov Discloses Supply Chain Compromise

The following blog was co-authored by Curt Barnard and Caitlin Condon. On April 15, 2021, code coverage and testing company Codecov announced a supply chain compromise in which a malicious party gained access to their Bash Uploader script and modified it without authorization, enabling the...

Debian DSA-4891-1 : tomcat9 - security update

Two vulnerabilities were discovered in the Tomcat servlet and JSP engine, which could result in information disclosure or denial of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4891. The text itse...

PT-2021-8378 · Unknown · Lz4 Bindings

Name of the Vulnerable Software and Affected Versions: LZ4 bindings affected versions not specified Description: The issue is related to the use of a deprecated C API in LZ4 bindings, which is vulnerable to memory corruption. This could potentially lead to arbitrary code execution if the bindings...

PT-2021-12076 · Github.Com/Yi Ge/Unzip +3 · Github.Com/Yi-Ge/Unzip +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory...

Palo Alto Networks PAN-OS 8.1.x < 8.1.19 / 9.0.x < 9.0.13 / 9.1.x < 9.1.4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 8.1.x prior to 8.1.19 or 9.0.x prior to 9.0.13 or 9.1.x prior to 9.1.4. It is, therefore, affected by a vulnerability. - An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where...

PT-2021-18223 · Pi-Hole · Pi-Hole

Name of the Vulnerable Software and Affected Versions: Pi-hole core version 5.2.4 Description: Multiple privilege escalation issues were discovered in Pi-hole core. Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. Recommendations: For version 5.2.4, update...

CVE-2021-28441

Technical details about CVE-2021-28441 are not provided in the connected documents. Monitor for updates from official advisories for affected products, scope, and fixes.

PT-2021-2668 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to incorrect code generation management in the Procedure Call Runtime component of Microsoft Windows operating systems. This allows a remote attacker to execu...

PT-2021-8264 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a use-after-free vulnerability in the vmbus open function. The "open info" variable is added to the &vmbus connection.chn msg list, but the error handling frees...

PT-2021-2737 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Microsoft Windows affected versions not specified Description: The issue is related to incorrect code generation management in the Remote Procedure Call Runtime. It allows remote attackers to execute arbitrary code and affect the system...

Pegasystem PEGA Platform 安全漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. An access control error vulnerability...

Investigating a unique “form” of email delivery for IcedID malware

Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are...

Investigating a unique “form” of email delivery for IcedID malware

Microsoft threat analysts have been tracking activity where contact forms published on websites are abused to deliver malicious links to enterprises using emails with fake legal threats. The emails instruct recipients to click a link to review supposed evidence behind their allegations, but are...

Hackers leak data, 600k card info from Swarmshop cybercrime forum

By Habiba Rashid Swarmshop data breach took place on March 17th, 2021 when an unknown hacker group leaked the data on underground hacker forums. This is a post from HackRead.com Read the original post: Hackers leak data, 600k card info from Swarmshop cybercrime forum...

Cross site scripting

A blind XSS vulnerability exists in Web-School ERP V 5.0 via Add Events in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attack...

CVE-2020-11234

When sending a socket event message to a user application, invalid information will be passed if socket is freed by other thread resulting in a Use After Free condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consum...

CVE-2020-11252

Trustzone initialization code will disable xPUs when memory dumps are enabled and lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Design/Logic Flaw

Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.3...

Research claims Google Pixel phones share 20 times more data than iPhones

If youre an Android phone user, now might be a good time to invest in a good pair of ear plugs. Fans of iPhones arent known for being shy when it comes to telling Android users that Apple products are superior, and things may be about to get worse, thanks to a new research paper pdf. Researchers ...