Mantra - A Tool Used To Hunt Down API Key Leaks In JS Files And Pages

The tool in question was created in Go and its main objective is to search for API keys in JavaScript files and HTML pages. It works by checking the source code of web pages and script files for strings that are identical or similar to API keys. These keys are often used for authentication to...

July 11, 2023—KB5028168 (OS Build 17763.4645) - EXPIRED

None None...

Credentials Leaks

cas-server-support-x509-core is vulnerable to Credentials Leaks. The vulnerability exists because the prepareConnectionFactory function of LdaptiveResourceCRLFetcher.java does not properly validate the ldapURL parameter provided by the certificate, leaking the credentials for LDAP authentication ...

Mozilla: Possibility of Deface through translation tool - www.mozilla.com

A vulnerability was discovered where credentials for a third-party translation tool used by Mozilla websites were publicly disclosed. This exposed access to translation management functions and internal documents. The issue was reported and it was advised that the disclosed passwords be changed t...

Debian: Security Advisory (DSA-5448-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ROS-2-1167

2.1167 Vulnerability in X.Org Server and libX11 CVE-2020-14347, CVE-2020-14344 1. Vulnerability Description: CVE-2020-14347 - Failure to initialize memory when allocating buffers for pixmaps using the AllocatePixmap call could cause the X client to leak memory contents from the heap when the X...

Secrets, Secrets Are No Fun. Secrets, Secrets (Stored in Plain Text Files) Hurt Someone

Secrets are meant to be hidden or, at the very least, only known to a specific and limited set of individuals or systems. Otherwise, they aren't really secrets. In personal life, a secret revealed can damage relationships, lead to social stigma, or, at the very least, be embarrassing. In a...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from a lack of boundary checking, which could result in out-of-bounds reads, which could lead to local information leaks...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that stems from insecure defaults that may use unencrypted transmissions over cellular networks, which could lead to remote information leaks...

Google Pixel 安全漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that stems from insecure defaults that may use unencrypted transmissions over cellular networks, which could lead to remote information leaks...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from insecure deserialization and possible out-of-bounds reads, which could lead to local information leaks...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from incorrect input validation, which could result in out-of-bounds reads, which could lead to local information leaks...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from incorrect input validation, which could result in out-of-bounds reads, which could lead to local information leaks...

Google Pixel 缓冲区错误漏洞

Google Pixel is a smartphone from the American company Google Google. Google Pixel suffers from a security vulnerability that stems from a lack of boundary checking, which could result in out-of-bounds reads, which could lead to remote information leaks...

CLSA-2023-1687795384 Fix CVE(s): CVE-2023-25584, CVE-2017-12450, CVE-2023-25588, CVE-2023-25585

SECURITY UPDATE: fixing the existing CVE-2017-12450 patches that were incorrectly ported from upstream - debian/patches/CVE-2017-12450-1.patch: fix address violation errors - debian/patches/CVE-2017-12450-2.patch: import patches from mainline to fix minor binutils bugs - CVE-2017-12450 SECURITY...

PT-2023-3677

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the init cea offsets function in the /arch/x86/mm/cpu entry area.c module of the Linux kernel's memory management subsystem. It concerns the accessibility of the...

Generative-AI apps & ChatGPT: Potential risks and mitigation strategies

Losing sleep over Generative-AI apps? You're not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Contin...

SUSE-SU-2023:2598-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus: - Security issues fixed in this version update to 2.37.6: CVE-2022-46146: Fix basic authentication bypass vulnerability bsc1208049, jscPED-3576 CVE-2022-41715: Update our regexp...

CVE-2023-20885 CF workflows leak credentials in system audit logs

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions...

URLs have always been a great hiding place for threat actors

Welcome to this weeks edition of the Threat Source newsletter. Talos recent blog post on the dangers posed by the newly released ".zip" top-level domain TLD recently outlined how threat actors could create real URLs that look like file names and trick users into clicking on their links. .Zip and...