4479 matches found
CVE-2021-43833
CVE-2021-43833 affects eLabFTW prior to version 4.2.0, where an authenticated user can gain access to arbitrary accounts by supplying a specially crafted email address. The issue applies to instances lacking an explicit email domain allowlist. Administrators’ and target users’ notifications are n...
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture SEAR group for collaborating with us on the technical analysis. The editorial opinions reflected below ar...
Apple iOS Update Fixes Cringey iPhone 13 Jailbreak Exploit
As if the Log4Shell hellscape wasn’t already driving everybody starkers, it’s time to update iOS 15.2 and a crop of other Apple iGadgets, lest your iPhone get taken over by a malicious app that executes arbitrary code with kernel privileges. To paraphrase one mobile security expert, the iOS 15.2...
meterN v1.2.3 Authenticated Remote Command Execution Vulnerability
Summary meterN is a set of PHP/JS files that make a -Home energy metering & monitoring- solution. It accept any meters like : electrical, water, gas, fuel consumption, solar, Wind energy production and so on. Sensors such as temperature or humidity are also accepted. The philosophy is: To keep it...
Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center
Windows 10 and Windows 11 have continued to raise the security bar for drivers running in the kernel. Kernel-mode driver publishers must pass the Hardware Lab Kit HLK compatibility tests, malware scanning, and prove their identity through extended validation EV certificates. This has significantl...
NSO Group spyware found on iPhones of US State Department employees
iPhones of at least nine US State Department employees are said to have been hacked using the Pegasus spyware developed by the Israeli technology company, NSO Group. Pegasus is a proprietary and sophisticated spyware capable of the remote surveillance of smartphones. The employees targeted by an...
GitHub Security Lab: [Java] CWE-400: Query to detect uncontrolled thread resource consumption
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [porcupiney.hairs]: [Python] Add Flask Path injection sinks
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: ihsinme: CPP Add query for CWE-675 Duplicate Operations on Resource
This bug was reported directly to GitHub Security Lab...
Intel Is Maintaining Legacy Technology for Security Research
Interesting: Intel’s issue reflects a wider concern: Legacy technology can introduce cybersecurity weaknesses. Tech makers constantly improve their products to take advantage of speed and power increases, but customers don’t always upgrade at the same pace. This creates a long tail of old product...
Apple Sues NSO Group
Piling more on NSO Groups legal troubles, Apple is suing it: The complaint provides new information on how NSO Group infected victims’ devices with its Pegasus spyware. To prevent further abuse and harm to its users, Apple is also seeking a permanent injunction to ban NSO Group from using any App...
GitHub Security Lab: [Python]: JWT security-related queries
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [Python]: CWE-079: HTTP Header injection
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: [GO]: [CWE-090: LDAP Injection All For One]
This bug was reported directly to GitHub Security Lab...
Kaspersky Total Security Directory Traversal Denial-of-Service Vulnerability
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Kaspersky Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...
GitHub Security Lab: Yet another SSRF query for Go
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Go
This bug was reported directly to GitHub Security Lab...
GitHub Security Lab: Yet another SSRF query for Go
This bug was reported directly to GitHub Security Lab...