38680 matches found
Northern.tech Mender Enterprise 代码问题漏洞
Northern.tech Mender Enterprise is a wireless update manager for IoT devices from Northern.tech. A security vulnerability exists in Northern.tech Mender Enterprise prior to version 3.2.2, which stems from the iot-manager microservice 1.0.0 that allows SSRF because the Azure IoT Hub integration...
The vulnerability of the Adobe Flash Player Desktop Runtime, FlashPlayer for Google Chrome, as well as Adobe FlashPlayer for Microsoft Edge and Internet Explorer, relates to reading data beyond the buffer in memory. This allows an attacker to gain unauthorized access to protected information.
The vulnerabilities of Adobe Flash Player Desktop Runtime, Flash Player for Google Chrome, as well as Adobe Flash Player for Microsoft Edge and Internet Explorer, are related to reading data beyond the buffer in memory. Exploiting these vulnerabilities can allow an attacker to gain unauthorized...
Millions of Java Apps Remain Vulnerable to Log4Shell
Four months after the discovery of the zero-day Log4Shell critical flaw, millions of Java applications still remain vulnerable to compromise, researchers have found. Rezilion expected that due to the “massive amount of media coverage” the bug unsurprisingly received, the majority of applications...
Internet Bug Bounty: CVE-2022-27774: Credential leak on redirect
Summary: curl/libcurl can be coaxed to leak user credentials to third-party host by issuing HTTP redirect to ftp:// URL. Steps To Reproduce: 1. Configure for example Apache2 on firstsite.tld to perform redirect with modrewrite: RewriteCond %HTTPUSERAGENT "^curl/" RewriteRule ^/redirectpoc...
cifs-utils缓冲区错误漏洞
cifs-utils is a toolkit from the individual developer Pavel Shilovsky. It provides utilities for managing CIFS network file system installations. A security vulnerability exists in piastry cifs-utils versions prior to 6.14, which stems from a stack-based buffer overflow when the application parse...
Hospitals taken offline after cyberattack
The GHT Coeur Grand Est has become a victim of a cyberattack on the hospital centers of Vitry-le-François and Saint-Dizier. The hospital’s administration has warned French that data have been exfiltrated and might be used for phishing in the future. As a consequence, the GHT Cœur Grand Est has cu...
Microsoft best practices for managing IoT security concerns
The Internet of Things, or IoT, has expanded beyond the mere concept that it was when first introduced. IoT is now part of most individuals’ daily activities, from smart speakers and thermostats to smartwatches and vehicles. IoT devices and systems bring massive convenience and functionality. IoT...
Internet Bug Bounty: CVE-2022-28738: Double free in Regexp compilation
Due to a bug in the Regexp compilation process, creating a Regexp object with a crafted source string could cause the same memory to be freed twice. This is known as a “double free” vulnerability. Note that, in general, it is considered unsafe to create and use a Regexp object generated from...
Trend Micro Partnering with Bit Discovery
We’re excited to partner with Bit Discovery, bringing attack surface discovery capabilities to the Trend Micro One platform, providing ongoing visibility to internal assets devices, identities, applications but also external, internet-facing assets...
New Partner Bit Discovery Helps TM with Attack Surface
We’re excited to partner with Bit Discovery, bringing attack surface discovery capabilities to the Trend Micro One platform, providing ongoing visibility to internal assets devices, identities, applications but also external, internet-facing assets...
Opportunistic Exploitation of WSO2 CVE-2022-29464
On April 18, 2022, MITRE published CVE-2022-29464 , an unrestricted file upload vulnerability affecting various WSO2 products. WSO2 followed with a security advisory explaining the vulnerability allowed unauthenticated and remote attackers to execute arbitrary code in the following products: API...
Discover the anatomy of an external cyberattack surface with new RiskIQ report
The internet is now part of the network. That might sound like hyperbole, but the massive shift to hybrid and remote work and a multicloud environment means security teams must now defend their entire online ecosystem. Recent ransomware attacks against internet-facing systems have served as a...
Discover the anatomy of an external cyberattack surface with new RiskIQ report
The internet is now part of the network. That might sound like hyperbole, but the massive shift to hybrid and remote work and a multicloud environment means security teams must now defend their entire online ecosystem. Recent ransomware attacks against internet-facing systems have served as a...
The vulnerability of the Cisco IOS XE operating system’s IPSec decryption process allows a attacker to trigger a device reboot or cause a service failure.
The vulnerability of the Cisco IOS XE operating system’s IPSec decryption process exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger a device reboot or cause a service failure using a specially crafted IPSec packet...
MDT KNXnet/IP Secure router和MDT KNX IP interface 安全漏洞
The MDT KNXnet/IP Secure router and the MDT KNX IP interface are both products of the German company MDT.The MDT KNXnet/IP Secure router is a series of secure routers.The MDT KNX IP interface is an interface. The MDT KNX IP interface is an interface that connects the KNX bus to the Ethernet. A...
The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus relates to errors in processing ICMP packet headers. This vulnerability allows attackers to gain access to protected information or cause service interruptions.
The vulnerability of microprogrammed software for controllers CAPITAL VSTAR, APOGEE MBC, APOGEE MEC, APOGEE PXC, TALON TC, and the operating system Nucleus is related to errors in processing ICMP packet headers. Exploiting this vulnerability can allow a remote attacker to gain access to protected...
4 Bad Bots Likely to Cause Problems for the Remainder of 2022
A short primer on internet bots An Internet bot bot, for short is a software application that runs automated tasks over the internet. Bots typically run simple tasks which they can perform at a dramatically greater rate than any human. Beneficial or anodyne bots are characterized as legitimate, o...
The vulnerability in the implementation of the ICMPv6 network protocol in Linux operating systems allows a hacker to induce a service failure.
The vulnerability of the ICMPv6 protocol implementation in Linux operating systems is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending specially crafted ICMPv6 packets of types 130 o...
Microsoft Patch Tuesday, April 2022 Edition
Microsoft on Tuesday released updates to fix roughly 120 security vulnerabilities in its Windows operating systems and other software. Two of the flaws have been publicly detailed prior to this week, and one is already seeing active exploitation, according to a report from the U.S. National...
curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols
A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...